Fix ci (#269)

Co-authored-by: Matthew Fernandez <l3acon@users.noreply.github.com>

.ansible-lint

@@ -1,12 +1,19 @@
 ---
 profile: production
-offline: false
+offline: true
 
 skip_list:
   - "galaxy[no-changelog]"
 
+warn_list:
+  # seems to be a bug, see https://github.com/ansible/ansible-lint/issues/4172
+  - "fqcn[canonical]"
+  # @matferna: really not sure why lint thinks it can't find jmespath, it is installed and functional
+  - "jinja[invalid]"
+
 exclude_paths:
   # would be better to move the roles here to the top-level roles directory
   - collections/ansible_collections/demo/compliance/roles/
   - roles/redhatofficial.*
   - .github/
+  - execution_environments/ee_contexts/

.github/workflows/README.md

@@ -0,0 +1,25 @@
+# GitHub Actions
+## Background
+We want to make attempts to run our integration tests in the same manner wether using GitHub actions or on a developers's machine locally. For this reason, the tests are curated to run using container images. As of this writing, two images exist which we would like to test against:
+  - quay.io/ansible-product-demos/apd-ee-24:latest
+  - quay.io/ansible-product-demos/apd-ee-25:latest
+
+These images are built given the structure defined in their respective EE [definitions][../execution_environments]. Because they differ (mainly due to their python versions), each gets some special handling.
+
+## Troubleshooting GitHub Actions
+
+### Interactive
+It is likely the most straight-forward approach to interactively debug issues. The following podman command can be run from the project root directory to replicate the GitHub action:
+```
+podman run \
+           --user root  \
+           -v $(pwd):/runner:Z \
+           -it \
+           <image> \
+           /bin/bash
+```
+`<image>` is one of `quay.io/ansible-product-demos/apd-ee-25:latest`, `quay.io/ansible-product-demos/apd-ee-24:latest`
+It is not exact because GitHub seems to run closer to a sidecar container paradigm, and uses docker instead of podman, but hopefully it's close enough.
+
+For the 24 EE, the python interpreriter verions is set for our pre-commit script like so: `USE_PYTHON=python3.9 ./.github/workflows/run-pc.sh`
+The 25 EE is similary run but without the need for this variable: `./.github/workflows/run-pc.sh`

.github/workflows/pre-commit.yml

@@ -4,14 +4,14 @@ on:
  - push
  - pull_request_target
 
-env:
-  ANSIBLE_GALAXY_SERVER_AH_TOKEN: ${{ secrets.ANSIBLE_GALAXY_SERVER_AH_TOKEN }}
-
 jobs:
-  pre-commit:
-    name: pre-commit
+  pre-commit-25:
+    container:
+      image: quay.io/ansible-product-demos/apd-ee-25
+      options: --user root
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v3
-    - uses: pre-commit/action@v3.0.0
+    - uses: actions/checkout@v4
+    - run: ./.github/workflows/run-pc.sh
+      shell: bash
+

.github/workflows/run-pc.sh

@@ -0,0 +1,25 @@
+#!/bin/bash -x
+
+# should no longer need this
+#dnf install git-lfs -y
+
+PYTHON_VARIANT="${USE_PYTHON:-python3.11}"
+PATH="$PATH:$HOME/.local/bin"
+
+# intsall pip
+eval "${PYTHON_VARIANT} -m pip install --user --upgrade pip"
+
+# try to fix 2.4 incompatibility 
+eval "${PYTHON_VARIANT} -m pip install --user --upgrade setuptools wheel twine check-wheel-contents"
+
+# intsall pre-commit
+eval "${PYTHON_VARIANT} -m pip install --user pre-commit"
+
+# view pip packages
+eval "${PYTHON_VARIANT} -m pip freeze --local"
+
+# fix permissions on directory
+git config --global --add safe.directory $(pwd)
+
+# run pre-commit
+pre-commit run --config $(pwd)/.pre-commit-gh.yml --show-diff-on-failure --color=always 

.gitignore

@@ -7,6 +7,10 @@ choose_demo_example_aws.yml
 .ansible.cfg
 *.gz
 *artifact*.json
-**/roles/*
-!**/roles/requirements.yml
+roles/*
+!roles/requirements.yml
 .deployment_id
+.cache/
+.ansible/
+**/tmp/
+execution_environments/context/

.pre-commit-config.yaml

@@ -3,8 +3,8 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.4.0
     hooks:
-      - id: end-of-file-fixer
       - id: trailing-whitespace
+        exclude: rhel[89]STIG/.*$
 
       - id: check-yaml
         exclude: \.j2.(yaml|yml)$|\.(yaml|yml).j2$
@@ -14,16 +14,16 @@ repos:
       - id: check-json
       - id: check-symlinks
 
-  - repo: https://github.com/ansible/ansible-lint.git
-    # get latest release tag from https://github.com/ansible/ansible-lint/releases/
-    rev: v6.20.3
+  - repo: local
     hooks:
       - id: ansible-lint
-        additional_dependencies:
-          - jmespath
+        name: ansible-navigator lint --eei quay.io/ansible-product-demos/apd-ee-25:latest --mode stdout
+        language: python
+        entry: bash -c "ansible-navigator lint --eei quay.io/ansible-product-demos/apd-ee-25 -v --force-color --mode stdout"
 
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 23.11.0
     hooks:
       - id: black
+        exclude: rhel[89]STIG/.*$
 ...

.pre-commit-gh.yml

@@ -0,0 +1,30 @@
+---
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: rhel[89]STIG/.*$
+
+      - id: check-yaml
+        exclude: \.j2.(yaml|yml)$|\.(yaml|yml).j2$
+        args: [--unsafe]   # see https://github.com/pre-commit/pre-commit-hooks/issues/273
+
+      - id: check-toml
+      - id: check-json
+      - id: check-symlinks
+
+  - repo: https://github.com/ansible/ansible-lint.git
+    # get latest release tag from https://github.com/ansible/ansible-lint/releases/
+    rev: v25.7.0
+    hooks:
+      - id: ansible-lint
+        additional_dependencies:
+          - jmespath
+
+  - repo: https://github.com/psf/black-pre-commit-mirror
+    rev: 23.11.0
+    hooks:
+      - id: black
+        exclude: rhel[89]STIG/.*$
+...

CHANGELOG.md

@@ -1,12 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [v-0.0.1](https://github.com/ansible/product-demos/-/tree/v-0.0.1) - 2024-01-12
-
-### Added
-
-- Initial release  ([1af584b4ea6d77812bfcb2f6474fee6ee1b13666](https://github.com/ansible/product-demos/-/commit/1af584b4ea6d77812bfcb2f6474fee6ee1b13666))

CONTRIBUTING.md

@@ -18,6 +18,7 @@ This document aims to outline the requirements for the various forms of contribu
 - PRs should be rebased against the `main` branch to avoid conflicts.
 - PRs should not impact more than a single directory/demo section.
 - PRs should not rely on external infrastructure or configuration unless the dependency is automated or specified in the `user_message` of `setup.yml`.
+- PR titles should describe the work done in the PR.  Titles should not be generic ("Added new demo") and should not refer to an issue number ("Fix for issue #123").
 
 ## Adding a New Demo
 1) Create a new branch based on main. (eg. `git checkout -b <branch name>`)
@@ -31,7 +32,7 @@ This document aims to outline the requirements for the various forms of contribu
    1) You can copy paste an existing one and edit it.
    2) Ensure you edit the name, playbook path, survey etc.
 5) Add any needed roles/collections to the [requirements.yml](/collections/requirements.yml)
-6) Test via [demo.redhat.com](https://demo.redhat.com/catalog?item=babylon-catalog-prod/sandboxes-gpte.aap-product-demos.prod&utm_source=webapp&utm_medium=share-link), specify your branch name within the project configuration.
+6) Test via [demo.redhat.com](https://demo.redhat.com/catalog?search=product&item=babylon-catalog-prod%2Fopenshift-cnv.aap-product-demos-cnv.prod), specifying your branch name within the project configuration.
 
 > NOTE: demo.redhat.com is available to Red Hat Associates and Partners with a valid account.
 
@@ -43,13 +44,10 @@ This document aims to outline the requirements for the various forms of contribu
     ---
     user_message: ''
 
-    controller_components:
-    - job_templates
-
     controller_templates:
     ...
     ```
-   - `controller_components` can be any of the roles defined [here](https://github.com/redhat-cop/controller_configuration/tree/devel/roles)
+   - Configuration variables can be from any of the roles defined in the [infra.controller_configuration collection](https://github.com/redhat-cop/controller_configuration/tree/devel/roles)
    - Add variables for each component listed
 3) Include a README.md in the subdirectory
 
@@ -72,76 +70,3 @@ Copy the token value and execute the following command:
 ```bash
 export ANSIBLE_GALAXY_SERVER_AH_TOKEN=<token>
 ```
-
-## Release Process
-
-We follow a structured release process for this project. Here are the steps involved:
-
-1. **Create a Release Branch:**
-   - Start by creating a new release branch from the `main` branch.
-
-   ```bash
-   git checkout -b release/v-<version>
-   ```
-
-2. **Update Changelog:**
-   - Open the `CHANGELOG.md` file to manually add your change to the appropriate section.
-   - Our changelog follows the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) format and includes the following categories of changes:
-
-     - `Added` for new features.
-     - `Changed` for changes in existing functionality.
-     - `Deprecated` for features that will be removed in upcoming releases.
-     - `Fixed` for bug fixes.
-     - `Removed` for deprecated features that were removed.
-     - `Security` for security-related changes.
-
-   - Add a new entry under the relevant category. Include a brief summary of the change and the merge request commit tag.
-
-     ```markdown
-     ## [Unreleased]
-
-     ### Added
-
-     - New feature or enhancement ([Merge Request Commit](https://github.com/ansible/product-demos/-/commit/<commit-hash>))
-     ```
-
-   - Replace `<commit-hash>` with the actual commit hash from the merge request.
-
-3. **Commit Changes:**
-   - Commit the changes made to the `CHANGELOG.md` file.
-
-   ```bash
-   git add CHANGELOG.md
-   git commit -m "Update CHANGELOG for release <version>"
-   ```
-
-4. **Create a Pull Request:**
-   - Open a pull request from the release branch to the `main` branch.
-
-5. **Review and Merge:**
-   - Review the pull request and merge it into the `main` branch.
-
-6. **Tag the Release:**
-   - Once the pull request is merged, tag the release with the version number.
-
-   ```bash
-   git tag -a v-<version> -m "Release <version>"
-   git push origin v-<version>
-   ```
-
-7. **Publish the Release:**
-   - After the successful completion of the pull request and merging into the `main` branch, an automatic GitHub Action will be triggered to publish the release.
-
-     The GitHub Action will perform the following steps:
-     - Parse the `CHANGELOG.md` file.
-     - Generate a release note based on the changes.
-     - Attach relevant files (such as `LICENSE`, `CHANGELOG.md`, and the generated `CHANGELOG.txt`) to the GitHub Release.
-
-     No manual intervention is required for this step; the GitHub Action will handle the release process automatically.
-
-8. **Cleanup:**
-   - Delete the release branch.
-
-   ```bash
-   git branch -d release/v-<version>
-   ```

README.md

@@ -1,66 +1,34 @@
-[![Lab](https://img.shields.io/badge/Try%20Me-EE0000?style=for-the-badge&logo=redhat&logoColor=white)](https://red.ht/aap-product-demos)
+[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
 [![Dev Spaces](https://img.shields.io/badge/Customize%20Here-0078d7.svg?style=for-the-badge&logo=visual-studio-code&logoColor=white)](https://workspaces.openshift.com/f?url=https://github.com/ansible/product-demos)
 
-# Official Ansible Product Demos
+# APD - Ansible Product Demos
 
-This is a centralized location for Ansible Product Demos. This project is a collection of use cases implemented with Ansible for use with the Ansible Automation Platform.
+The Ansible Product Demos (APD) project is a set of Ansible demos that are deployed using [Red Hat Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible).  It uses configuraton-as-code to create AAP resources such as projects, templates, and credentials that form the basis for demonstrating automation use cases in several technology domains:
 
 | Demo Name | Description |
 |-----------|-------------|
 | [Linux](linux/README.md) | Repository of demos for RHEL and Linux automation |
 | [Windows](windows/README.md) | Repository of demos for Windows Server automation |
 | [Cloud](cloud/README.md) | Demo for infrastructure and cloud provisioning automation |
-| [Network](network/README.md) | Ansible Network automation demos |
+| [Network](network/README.md) | Network automation demos |
+| [OpenShift](openshift/README.md) | OpenShift automation demos |
 | [Satellite](satellite/README.md) | Demos of automation with Red Hat Satellite Server |
 
-## Contributions
-
-If you would like to contribute to this project please refer to [contribution guide](CONTRIBUTING.md) for best practices.
-
 ## Using this project
 
-This project is tested for compatibility with the [demo.redhat.com Product Demos Sandbox]([red.ht/aap-product-demos](https://demo.redhat.com/catalog?item=babylon-catalog-prod/sandboxes-gpte.aap-product-demos.prod&utm_source=webapp&utm_medium=share-link)) lab environment. To use with other Ansible Controller installations, review the [prerequisite documentation](https://github.com/RedHatGov/ansible-tower-samples).
+Use the [APD bootstrap](https://github.com/ansible/product-demos-bootstrap) repo to add APD to an existing Ansible Automation Platform deployment.  The bootstrap repo provides the initial manual prerequisite steps as well as a playbook for adding APD to the existing deployment.
 
-> NOTE: demo.redhat.com is available to Red Hat Associates and Partners with a valid account.
-
-1. First you must create a credential for [Automation Hub](https://console.redhat.com/ansible/automation-hub/) to successfully sync collections used by this project.
-
-   1. In the Credentials section of the Controller UI, add a new Credential called `Automation Hub` with the type `Ansible Galaxy/Automation Hub API Token`
-   2. You can obtain a token [here](https://console.redhat.com/ansible/automation-hub/token). This page will also provide the Server URL and Auth Server URL.
-   3. Next, click on Organizations and edit the `Default` organization. Add your `Automation Hub` credential to the `Galaxy Credentials` section. Don't forget to click **Save**!!
-
-      > You can also use an execution environment for disconnected environments. To do this, you must disable collection downloads in the Controller. This can be done in `Settings` > `Job Settings`. This setting prevents the controller from downloading collections listed in the [collections/requirements.yml](collections/requirements.yml) file.
-
-2. If it is not already created for you, add an Execution Environment called `product-demos`
-
-     - Name: product-demos
-     - Image: quay.io/acme_corp/product-demos-ee:latest
-     - Pull: Only pull the image if not present before running
-
-3. If it is not already created for you, create a Project called `Ansible official demo project` with this repo as a source. NOTE: if you are using a fork, be sure that you have the correct URL. Update the project.
-
-4. Finally, Create a Job Template called `Setup` with the following configuration:
-
-     - Name: Setup
-     - Inventory: Demo Inventory
-     - Exec Env: product-demos
-     - Playbook: setup_demo.yml
-     - Credentials:
-        - Type: Red Hat Ansible Automation Platform
-        - Name: Controller Credential
-     - Extra vars:
-
-            demo: <linux or windows or cloud or network>
+For Red Hat associates and partners, there is an Ansible Product Demos catalog item [available on demo.redhat.com](https://red.ht/apd-sandbox) (account required).
 
 ## Bring Your Own Demo
 
 Can't find what you're looking for? Customize this repo to make it your own.
 
 1. Create a fork of this repo.
-2. Update the URL of the `Ansible official demo project` in the Controller.
-3. Make changes as needed and run the **Setup** job
+2. Update the URL of the `Ansible Project Demos` project your Ansible Automation Platform controller.
+3. Make changes to your fork as needed and run the **Product Demos | Single demo setup** job
 
-See the [contribution guide](CONTRIBUTING.md) for more details on how to customize the project.
+See the [contributing guide](CONTRIBUTING.md) for more details on how to customize the project.
 
 ---
 

ansible.cfg

@@ -1,16 +1,20 @@
 [defaults]
-collections_path=./collections
+collections_path=./collections:/usr/share/ansible/collections
 roles_path=./roles
 
 [galaxy]
-server_list = ah,galaxy
+server_list = certified,validated,galaxy
 
-[galaxy_server.ah]
+[galaxy_server.certified]
 # Grab a token at https://console.redhat.com/ansible/automation-hub/token
-# Then define it using ANSIBLE_GALAXY_SERVER_AH_TOKEN=""
-
+# Then define it in the ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN environment variable
 url=https://console.redhat.com/api/automation-hub/content/published/
 auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
 
+[galaxy_server.validated]
+# Define the token in the ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN environment variable
+url=https://console.redhat.com/api/automation-hub/content/validated/
+auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+
 [galaxy_server.galaxy]
 url=https://galaxy.ansible.com/

cloud/README.md

@@ -10,7 +10,7 @@
     - [Configure Credentials](#configure-credentials)
     - [Add Workshop Credential Password](#add-workshop-credential-password)
     - [Remove Inventory Variables](#remove-inventory-variables)
-    - [Getting your Puiblic Key for Create Keypair Job](#getting-your-puiblic-key-for-create-keypair-job)
+    - [Getting your Public Key for Create Keypair Job](#getting-your-public-key-for-create-keypair-job)
   - [Suggested Usage](#suggested-usage)
   - [Known Issues](#known-issues)
 
@@ -19,12 +19,11 @@ This category of demos shows examples of multi-cloud provisioning and management
 
 ### Jobs
 
-- [**Cloud / Create Infra**](create_infra.yml) - Creates a VPC with required routing and firewall rules for provisioning VMs
-- [**Cloud / Create Keypair**](aws_key.yml) - Creates a keypair for connecting to EC2 instances
-- [**Cloud / Create VM**](create_vm.yml) - Create a VM based on a [blueprint](blueprints/) in the selected cloud provider
-- [**Cloud / Destroy VM**](destroy_vm.yml) - Destroy a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be deleted.
-- [**Cloud / Snapshot EC2**](snapshot_ec2.yml) - Snapshot a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be snapshot.
-- [**Cloud / Restore EC2 from Snapshot**](snapshot_ec2.yml) - Restore a VM that has been created in a cloud provider.  By default, volumes will be restored from their latest snapshot. VM must be imported into dynamic inventory to be patched.
+- [**Cloud / AWS / Create VM**](create_vm.yml) - Create a VM based on a [blueprint](blueprints/) in the selected cloud provider
+- [**Cloud / AWS / Destroy VM**](destroy_vm.yml) - Destroy a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be deleted.
+- [**Cloud / AWS / Snapshot EC2**](snapshot_ec2.yml) - Snapshot a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be snapshot.
+- [**Cloud / AWS / Restore EC2 from Snapshot**](snapshot_ec2.yml) - Restore a VM that has been created in a cloud provider.  By default, volumes will be restored from their latest snapshot. VM must be imported into dynamic inventory to be patched.
+- [**Cloud / Resize EC2**](resize_ec2.yml) - Re-size an EC2 instance.
 
 ### Inventory
 
@@ -49,21 +48,23 @@ After running the setup job template, there are a few steps required to make the
 
 1) Remove Workshop Inventory variables on the Details page of the inventory. Required until [RFE](https://github.com/ansible/workshops/issues/1597]) is complete
 
-### Getting your Puiblic Key for Create Keypair Job
+### Getting your Public Key for Create Keypair Job
 
 1) Connect to the command line of your Controller server. This is easiest to do by opening the VS Code Web Editor from the landing page where you found the Controller login details.
 2) Open a Terminal Window in the VS Code Web Editor.
-3) SSH to one of your linux nodes (eg. `ssh node1`). This should log you into the node as `ec2-user`
+3) SSH to one of your linux nodes (eg. `ssh aws_rhel9`). This should log you into the node as `ec2-user`
 4) `cat .ssh/authorized_keys` and copy the key listed including the  `ssh-rsa` prefix
 
 
 ## Suggested Usage
 
-**Cloud / Create Keypair** - The Create Keypair job creates an EC2 keypair which can be used when creating EC2 instances to enable SSH access.
+**Deploy Cloud Stack in AWS** - This workflow builds out many helpful and convient resources in AWS. Given an AWS region, key, and some organizational paremetres for tagging it builds a default VPC, keypair, five VMs (three RHEL and two Windows), and even provides a report for cloud stats. It is the typical starting point for using Ansible Product-Demos in AWS.
 
 **Cloud / Create VM** - The Create VM job builds a VM in the given provider based on the included `demo.cloud` collection. VM [blueprints](blueprints/) define variables for each provider that override the defaults in the collection. When creating VMs it is recommended to follow naming conventions that can be used as host patterns. (eg. VM names: `win1`, `win2`, `win3`.  Host Pattern: `win*` )
 
 **Cloud / AWS / Patch EC2 Workflow** - Create a VPC and one or more linux VM(s) in AWS using the `Cloud / Create VPC` and `Cloud / Create VM` templates. Run the workflow and observe the instance snapshots followed by patching operation. Optionally, use the survey to force a patch failure in order to demonstrate the restore path. At this time, the workflow does not support patching Windows instances.
 
+**Cloud / AWS / Resize EC2** - Given an EC2 instance, change its size. This takes an AWS region, target host pattern, and a target instance size as parameters. As a final step, this job refreshes the AWS inventory so the re-created instance is accessible from AAP.
+
 ## Known Issues
 Azure does not work without a custom execution environment that includes the Azure dependencies.

cloud/aws_key.yml

@@ -23,3 +23,8 @@
         state: present
         tags:
           owner: "{{ aws_keypair_owner }}"
+
+    - name: Set VPC stats
+      ansible.builtin.set_stats:
+        data:
+          stat_aws_key_pair: '{{ aws_key_name }}'

cloud/create_vpc.yml

@@ -2,6 +2,7 @@
 - name: Create Cloud Infra
   hosts: localhost
   gather_facts: false
+
   vars:
     aws_vpc_name: aws-test-vpc
     aws_owner_tag: default
@@ -13,6 +14,27 @@
     aws_subnet_name: aws-test-subnet
     aws_rt_name: aws-test-rt
 
+    # map of availability zones to use per region, added since not all
+    # instance types are available in all AZs.  must match the drop-down
+    # list for the create_vm_aws_region variable described in cloud/setup.yml
+    _azs:
+      us-east-1:
+        - us-east-1a
+        - us-east-1b
+        - us-east-1c
+      us-east-2:
+        - us-east-2a
+        - us-east-2b
+        - us-east-2c
+      us-west-1:
+        # us-west-1a not available when last checked 20250218
+        - us-west-1b
+        - us-west-1c
+      us-west-2:
+        - us-west-2a
+        - us-west-2b
+        - us-west-2c
+
   tasks:
     - name: Create VPC
       amazon.aws.ec2_vpc_net:
@@ -95,12 +117,13 @@
           owner: "{{ aws_owner_tag }}"
           purpose: "{{ aws_purpose_tag }}"
 
-    - name: Create a subnet on the VPC
+    - name: Create a subnet in the VPC
       amazon.aws.ec2_vpc_subnet:
         state: present
         vpc_id: "{{ aws_vpc.vpc.id }}"
         cidr: "{{ aws_subnet_cidr }}"
         region: "{{ create_vm_aws_region }}"
+        az: "{{ _azs[create_vm_aws_region] | shuffle | first }}"
         map_public: true
         tags:
           Name: "{{ aws_subnet_name }}"
@@ -122,3 +145,12 @@
           Name: "{{ aws_rt_name }}"
           owner: "{{ aws_owner_tag }}"
           purpose: "{{ aws_purpose_tag }}"
+
+    - name: Set VPC stats
+      ansible.builtin.set_stats:
+        data:
+          stat_aws_region: '{{ create_vm_aws_region }}'
+          stat_aws_vpc_id: '{{ aws_vpc.vpc.id }}'
+          stat_aws_vpc_cidr: '{{ aws_vpc_cidr_block }}'
+          stat_aws_subnet_id: '{{ aws_subnet.subnet.id }}'
+          stat_aws_subnet_cidr: '{{ aws_subnet_cidr }}'

cloud/display-ec2-stats.yml

@@ -0,0 +1,18 @@
+---
+- name: Display EC2 stats
+  hosts: localhost
+  gather_facts: false
+
+  tasks:
+    - name: Display stats for EC2 VPC and key pair
+      ansible.builtin.debug:
+        var: '{{ item }}'
+      loop:
+        - stat_aws_region
+        - stat_aws_key_pair
+        - stat_aws_vpc_id
+        - stat_aws_vpc_cidr
+        - stat_aws_subnet_id
+        - stat_aws_subnet_cidr
+
+...

cloud/resize_ec2.yml

@@ -0,0 +1,10 @@
+---
+- name: Resize ec2 instances
+  hosts: "{{ _hosts | default(omit) }}"
+  gather_facts: false
+
+  tasks:
+    - name: Include snapshot role
+      ansible.builtin.include_role:
+        name: "demo.cloud.aws"
+        tasks_from: resize_ec2

cloud/setup.yml

@@ -3,81 +3,6 @@ _deployment_id: "{{ lookup('file', playbook_dir + '/.deployment_id') }}"
 
 user_message:
 
-controller_execution_environments:
-  - name: Cloud Services Execution Environment
-    image: quay.io/scottharwell/cloud-ee:latest
-
-controller_projects:
-  - name: Ansible Cloud Content Lab - AWS
-    organization: Default
-    scm_type: git
-    wait: true
-    scm_url: https://github.com/ansible-content-lab/aws.infrastructure_config_demos.git
-    default_environment: Cloud Services Execution Environment
-
-controller_credentials:
-  - name: AWS
-    credential_type: Amazon Web Services
-    organization: Default
-    update_secrets: false
-    inputs:
-      username: REPLACEME
-      password: REPLACEME
-
-#  - name: Azure
-#    credential_type: Microsoft Azure Resource Manager
-#    organization: Default
-#    update_secrets: false
-#    inputs:
-#      subscription: REPLACEME
-
-controller_inventory_sources:
-  - name: AWS Inventory
-    organization: Default
-    source: ec2
-    inventory: Demo Inventory
-    credential: AWS
-    overwrite: true
-    source_vars:
-      hostnames:
-        - tag:Name
-      compose:
-        ansible_host: public_ip_address
-        ansible_user: 'ec2-user'
-      groups:
-        cloud_aws: true
-        os_linux: tags.blueprint.startswith('rhel')
-      keyed_groups:
-        - key: platform
-          prefix: os
-        - key: tags.blueprint
-          prefix: blueprint
-        - key: tags.owner
-          prefix: owner
-
-#  - name: Azure Inventory
-#    organization: Default
-#    source: azure_rm
-#   inventory: Demo Inventory
-#    credential: Azure
-#    execution_environment: Ansible Engine 2.9 execution environment
-#    overwrite: true
-#    source_vars:
-#      hostnames:
-#        - tags.Name
-#        - default
-#      keyed_groups:
-#        - key: os_profile.system
-#          prefix: os
-#      conditional_groups:
-#        cloud_azure: true
-
-controller_groups:
-  - name: cloud_aws
-    inventory: Demo Inventory
-    variables:
-      ansible_user: ec2-user
-
 controller_templates:
   - name: Cloud / AWS / Create Peer Infrastructure
     job_type: run
@@ -139,168 +64,21 @@ controller_templates:
     extra_vars:
       aws_region: us-east-1
 
-  - name: Cloud / AWS / Create VPC
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-    project: Ansible official demo project
-    playbook: cloud/create_vpc.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
-        - question_name: Owner
-          type: text
-          variable: aws_owner_tag
-          required: true
-
-  - name: Cloud / AWS / Create VM
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-      - Demo Credential
-    project: Ansible Cloud Content Lab - AWS
-    playbook: playbooks/create_vm.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    allow_simultaneous: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
-        - question_name: Name
-          type: text
-          variable: create_vm_vm_name
-          required: true
-        - question_name: Owner
-          type: text
-          variable: create_vm_vm_owner
-          required: true
-        - question_name: Deployment
-          type: text
-          variable: create_vm_vm_deployment
-          required: true
-        - question_name: Environment
-          type: multiplechoice
-          variable: create_vm_vm_environment
-          required: true
-          choices:
-            - Dev
-            - QA
-            - Prod
-        - question_name: Blueprint
-          type: multiplechoice
-          variable: vm_blueprint
-          required: true
-          choices:
-            - windows_core
-            - windows_full
-            - rhel9
-            - rhel8
-            - rhel7
-            - al2023
-        - question_name: Subnet
-          type: text
-          variable: create_vm_aws_vpc_subnet_name
-          required: true
-          default: aws-test-subnet
-        - question_name: Security Group
-          type: text
-          variable: create_vm_aws_securitygroup_name
-          required: true
-          default: aws-test-sg
-        - question_name: SSH Keypair
-          type: text
-          variable: create_vm_aws_keypair_name
-          required: true
-          default: aws-test-key
-        - question_name: AWS Instance Type (defaults to blueprint value)
-          type: text
-          variable: create_vm_aws_instance_size
-          required: false
-        - question_name: AWS Image Filter (defaults to blueprint value)
-          type: text
-          variable: create_vm_aws_image_filter
-          required: false
-
-  - name: Cloud / AWS / Delete VM
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-      - Demo Credential
-    project: Ansible Cloud Content Lab - AWS
-    playbook: playbooks/delete_inventory_vm.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: Name or Pattern
-          type: text
-          variable: _hosts
-          required: true
-
   - name: Cloud / AWS / VPC Report
     job_type: run
     organization: Default
     credentials:
       - AWS
-    project: Ansible Cloud Content Lab - AWS
-    playbook: playbooks/create_reports.yml
+    project: Ansible Cloud AWS Demos
+    playbook: playbooks/cloud_report.yml
     inventory: Demo Inventory
+    execution_environment: Cloud Services Execution Environment
     notification_templates_started: Telemetry
     notification_templates_success: Telemetry
     notification_templates_error: Telemetry
     extra_vars:
-      aws_report: vpc
       reports_aws_bucket_name: reports-pd-{{ _deployment_id }}
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
+      reports_aws_region: "us-east-1"
 
   - name: Cloud / AWS / Tags Report
     job_type: run
@@ -331,51 +109,12 @@ controller_templates:
             - us-west-1
             - us-west-2
 
-  - name: Cloud / AWS / Create Keypair
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-    project: Ansible official demo project
-    playbook: cloud/aws_key.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
-        - question_name: Keypair Name
-          type: text
-          variable: aws_key_name
-          required: true
-          default: aws-test-key
-        - question_name: Keypair Public Key
-          type: textarea
-          variable: aws_public_key
-          required: true
-        - question_name: Owner
-          type: text
-          variable: aws_keypair_owner
-          required: true
-
   - name: Cloud / AWS / Snapshot EC2
     job_type: run
     organization: Default
     credentials:
       - AWS
-    project: Ansible official demo project
+    project: Ansible Product Demos
     playbook: cloud/snapshot_ec2.yml
     inventory: Demo Inventory
     notification_templates_started: Telemetry
@@ -406,7 +145,7 @@ controller_templates:
     organization: Default
     credentials:
       - AWS
-    project: Ansible official demo project
+    project: Ansible Product Demos
     playbook: cloud/restore_ec2.yml
     inventory: Demo Inventory
     notification_templates_started: Telemetry
@@ -432,10 +171,22 @@ controller_templates:
           variable: _hosts
           required: false
 
+  - name: Cloud / AWS / Display EC2 Stats
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+    project: Ansible Product Demos
+    playbook: cloud/display-ec2-stats.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+
   - name: "LINUX / Patching"
     job_type: check
     inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
     playbook: "linux/patching.yml"
     execution_environment: Default execution environment
     notification_templates_started: Telemetry
@@ -502,19 +253,24 @@ controller_workflows:
       - identifier: Create Keypair
         unified_job_template: Cloud / AWS / Create Keypair
         success_nodes:
-          - VPC Report
+          - EC2 Stats
         failure_nodes:
           - Ticket - Keypair Failed
       - identifier: Create VPC
         unified_job_template: Cloud / AWS / Create VPC
         success_nodes:
-          - VPC Report
+          - EC2 Stats
         failure_nodes:
           - Ticket - VPC Failed
       - identifier: Ticket - Keypair Failed
         unified_job_template: 'SUBMIT FEEDBACK'
         extra_data:
           feedback: Failed to create AWS keypair
+      - identifier: EC2 Stats
+        unified_job_template: Cloud / AWS / Display EC2 Stats
+        all_parents_must_converge: true
+        always_nodes:
+          - VPC Report
       - identifier: VPC Report
         unified_job_template: Cloud / AWS / VPC Report
         all_parents_must_converge: true
@@ -523,10 +279,11 @@ controller_workflows:
           - Deploy RHEL8 Blueprint
           - Deploy RHEL9 Blueprint
           - Deploy Windows Core Blueprint
+          - Deploy Report Server
       - identifier: Deploy Windows GUI Blueprint
         unified_job_template: Cloud / AWS / Create VM
         extra_data:
-          create_vm_vm_name: aws_dc
+          create_vm_vm_name: aws-dc
           vm_blueprint: windows_full
         success_nodes:
           - Update Inventory
@@ -559,10 +316,15 @@ controller_workflows:
           - Update Inventory
         failure_nodes:
           - Ticket - Instance Failed
-      - identifier: Ticket - VPC Failed
-        unified_job_template: 'SUBMIT FEEDBACK'
+      - identifier: Deploy Report Server
+        unified_job_template: Cloud / AWS / Create VM
         extra_data:
-          feedback: Failed to create AWS VPC
+          create_vm_vm_name: reports
+          vm_blueprint: rhel9
+        success_nodes:
+          - Update Inventory
+        failure_nodes:
+          - Ticket - Instance Failed
       - identifier: Update Inventory
         unified_job_template: AWS Inventory
         success_nodes:
@@ -573,6 +335,10 @@ controller_workflows:
           feedback: Failed to create AWS instance
       - identifier: Tag Report
         unified_job_template: Cloud / AWS / Tags Report
+      - identifier: Ticket - VPC Failed
+        unified_job_template: 'SUBMIT FEEDBACK'
+        extra_data:
+          feedback: Failed to create AWS VPC
 
   - name: Cloud / AWS / Patch EC2 Workflow
     description: A workflow to patch ec2 instances with snapshot and restore on failure.
@@ -602,7 +368,7 @@ controller_workflows:
           default: os_linux
     simplified_workflow_nodes:
       - identifier: Project Sync
-        unified_job_template: Ansible official demo project
+        unified_job_template: Ansible Product Demos
         success_nodes:
           - Take Snapshot
       - identifier: Inventory Sync

collections/ansible_collections/demo/cloud/roles/aws/tasks/create_vm.yml

@@ -17,12 +17,12 @@
     filters:
       name: "{{ aws_image_filter }}"
       architecture: "{{ aws_image_architecture | default(omit) }}"
-  register: amis
+  register: aws_amis
 
 - name: AWS| CREATE VM | save ami
   ansible.builtin.set_fact:
     aws_instance_ami: >
-      {{ (amis.images | selectattr('name', 'defined') | sort(attribute='creation_date'))[-2] }}
+      {{ (aws_amis.images | selectattr('name', 'defined') | sort(attribute='creation_date'))[-2] }}
 
 - name: AWS| CREATE VM | create instance
   amazon.aws.ec2_instance:

collections/ansible_collections/demo/cloud/roles/aws/tasks/resize_ec2.yml

@@ -0,0 +1,45 @@
+---
+# parameters
+# instance_type: new instance type, e.g. t3.large
+- name: AWS | RESIZE VM
+  delegate_to: localhost
+  vars:
+    controller_dependency_check: false  # noqa: var-naming[no-role-prefix]
+    controller_inventory_sources:
+      - name: AWS Inventory
+        inventory: Demo Inventory
+        organization: Default
+        wait: true
+  block:
+    - name: AWS | RESIZE EC2 | assert required vars
+      ansible.builtin.assert:
+        that:
+          - instance_id is defined
+          - aws_region is defined
+        fail_msg: "instance_id, aws_region is required for resize operations"
+
+    - name: AWS | RESIZE EC2 | shutdown instance
+      amazon.aws.ec2_instance:
+        instance_ids: "{{ instance_id }}"
+        region: "{{ aws_region }}"
+        state: stopped
+        wait: true
+
+    - name: AWS | RESIZE EC2 | update instance type
+      amazon.aws.ec2_instance:
+        region: "{{ aws_region }}"
+        instance_ids: "{{ instance_id }}"
+        instance_type: "{{ instance_type }}"
+        wait: true
+
+    - name: AWS | RESIZE EC2 | start instance
+      amazon.aws.ec2_instance:
+        instance_ids: "{{ instance_id }}"
+        region: "{{ aws_region }}"
+        state: started
+        wait: true
+
+    - name: Synchronize inventory
+      run_once: true
+      ansible.builtin.include_role:
+        name: infra.controller_configuration.inventory_source_update

collections/ansible_collections/demo/cloud/roles/aws/tasks/restore_vm.yml

@@ -10,14 +10,14 @@
         wait: true
 
     - name: AWS | RESTORE VM | get volumes
-      register: r_vol_info
+      register: aws_r_vol_info
       amazon.aws.ec2_vol_info:
         region: "{{ aws_region }}"
         filters:
           attachment.instance-id: "{{ instance_id }}"
 
     - name: AWS | RESTORE VM | detach volumes
-      loop: "{{ r_vol_info.volumes }}"
+      loop: "{{ aws_r_vol_info.volumes }}"
       loop_control:
         loop_var: volume
         label: "{{ volume.id }}"
@@ -40,7 +40,7 @@
 
     - name: AWS | RESTORE VM | get all snapshots
       when: inventory_hostname not in aws_snapshots
-      register: r_snapshots
+      register: aws_r_snapshots
       amazon.aws.ec2_snapshot_info:
         region: "{{ aws_region }}"
         filters:
@@ -51,7 +51,7 @@
       amazon.aws.ec2_vol:
         region: "{{ aws_region }}"
         instance: "{{ instance_id }}"
-        snapshot: "{{ r_snapshots.snapshots[0].snapshot_id }}"
+        snapshot: "{{ aws_r_snapshots.snapshots[0].snapshot_id }}"
         device_name: "/dev/sda1"
 
     - name: AWS | RESTORE VM | start vm

collections/ansible_collections/demo/cloud/roles/aws/tasks/snapshot_vm.yml

@@ -12,18 +12,18 @@
         file: snapshot_vm.yml
 
     - name: AWS | SNAPSHOT VM | get volumes
-      register: r_vol_info
+      register: aws_r_vol_info
       amazon.aws.ec2_vol_info:
         region: "{{ aws_region }}"
         filters:
           attachment.instance-id: "{{ instance_id }}"
 
     - name: AWS | SNAPSHOT VM | take snapshots
-      loop: "{{ r_vol_info.volumes }}"
+      loop: "{{ aws_r_vol_info.volumes }}"
       loop_control:
         loop_var: volume
         label: "{{ volume.id }}"
-      register: r_snapshots
+      register: aws_r_snapshots
       amazon.aws.ec2_snapshot:
         region: "{{ aws_region }}"
         volume_id: "{{ volume.id }}"
@@ -32,11 +32,11 @@
 
 - name: AWS | SNAPSHOT VM | format snapshot stat
   ansible.builtin.set_fact:
-    snapshot_stat:
+    aws_snapshot_stat:
       - key: "{{ inventory_hostname }}"
-        value: "{{ r_snapshots.results | json_query(aws_ec2_snapshot_query) }}"
+        value: "{{ aws_r_snapshots.results | json_query(aws_ec2_snapshot_query) }}"
 
 - name: AWS | SNAPSHOT VM | record snapshot with host key
   ansible.builtin.set_stats:
     data:
-      aws_snapshots: "{{ snapshot_stat | items2dict }}"
+      aws_snapshots: "{{ aws_snapshot_stat | items2dict }}"

collections/ansible_collections/demo/compliance/roles/iosxeSTIG/tasks/main.yml

@@ -137,14 +137,14 @@
     - (cmd_result.stdout|join('\n')).find('ip dns server') != -1
     - iosxeSTIG_stigrule_215823_Manage
 # R-215823 CISC-ND-000470
-- name : stigrule_215823_disable_identd
-  ignore_errors: "{{ ignore_all_errors }}"
-  notify: "save configuration"
-  ios_config:
-    defaults: yes
-    lines: "{{ iosxeSTIG_stigrule_215823_disable_identd_Lines }}"
-  when:
-    - iosxeSTIG_stigrule_215823_Manage
+# - name : stigrule_215823_disable_identd
+#   ignore_errors: "{{ ignore_all_errors }}"
+#   notify: "save configuration"
+#   ios_config:
+#     defaults: yes
+#     lines: "{{ iosxeSTIG_stigrule_215823_disable_identd_Lines }}"
+#   when:
+#     - iosxeSTIG_stigrule_215823_Manage
 # R-215823 CISC-ND-000470
 - name : stigrule_215823_disable_finger
   ignore_errors: "{{ ignore_all_errors }}"
@@ -378,9 +378,9 @@
 - name : stigrule_215837_host
   ignore_errors: "{{ ignore_all_errors }}"
   notify: "save configuration"
-  ios_logging:
-    dest: host
-    name: "{{ iosxeSTIG_stigrule_215837_host_Name }}"
+  ios_config:
+    lines:
+      - "logging {{ iosxeSTIG_stigrule_215837_host_Name }}"
   when: iosxeSTIG_stigrule_215837_Manage
 # R-215837 CISC-ND-001000
 # Please configure name IP address to a valid one.
@@ -397,16 +397,18 @@
 - name : stigrule_215838_ntp_server_1
   ignore_errors: "{{ ignore_all_errors }}"
   notify: "save configuration"
-  ios_ntp:
-    server: "{{ iosxeSTIG_stigrule_215838_ntp_server_1_Server }}"
+  cisco.ios.ios_config:
+    lines:
+      - "ntp server {{ iosxeSTIG_stigrule_215838_ntp_server_1_Server }}"
   when: iosxeSTIG_stigrule_215838_Manage
 # R-215838 CISC-ND-001030
 # Replace ntp servers' IP address before enabling.
 - name : stigrule_215838_ntp_server_2
   ignore_errors: "{{ ignore_all_errors }}"
   notify: "save configuration"
-  ios_ntp:
-    server: "{{ iosxeSTIG_stigrule_215838_ntp_server_2_Server }}"
+  cisco.ios.ios_config:
+    lines:
+      - "ntp server {{ iosxeSTIG_stigrule_215838_ntp_server_2_Server }}"
   when: iosxeSTIG_stigrule_215838_Manage
 # R-215840 CISC-ND-001050
 # service timestamps log datetime localtime is set in 215817.

collections/ansible_collections/demo/compliance/roles/rhel8STIG/callback_plugins/stig_xml.py

@@ -1,5 +1,4 @@
-from __future__ import absolute_import, division, print_function
-
+from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 from ansible.plugins.callback import CallbackBase
@@ -12,82 +11,76 @@ import os
 import xml.etree.ElementTree as ET
 import xml.dom.minidom
 
-
 class CallbackModule(CallbackBase):
     CALLBACK_VERSION = 2.0
-    CALLBACK_TYPE = "xml"
-    CALLBACK_NAME = "stig_xml"
+    CALLBACK_TYPE = 'xml'
+    CALLBACK_NAME = 'stig_xml'
 
     CALLBACK_NEEDS_WHITELIST = True
 
     def _get_STIG_path(self):
-        cwd = os.path.abspath(".")
+        cwd = os.path.abspath('.')
         for dirpath, dirs, files in os.walk(cwd):
-            if os.path.sep + "files" in dirpath and ".xml" in files[0]:
+            if os.path.sep + 'files' in dirpath and '.xml' in files[0]:
                 return os.path.join(cwd, dirpath, files[0])
 
     def __init__(self):
         super(CallbackModule, self).__init__()
         self.rules = {}
-        self.stig_path = os.environ.get("STIG_PATH")
-        self.XML_path = os.environ.get("XML_PATH")
+        self.stig_path = os.environ.get('STIG_PATH')
+        self.XML_path = os.environ.get('XML_PATH')
         if self.stig_path is None:
             self.stig_path = self._get_STIG_path()
-        self._display.display("Using STIG_PATH: {}".format(self.stig_path))
+        self._display.display('Using STIG_PATH: {}'.format(self.stig_path))
         if self.XML_path is None:
             self.XML_path = tempfile.mkdtemp() + "/xccdf-results.xml"
-        self._display.display("Using XML_PATH: {}".format(self.XML_path))
+        self._display.display('Using XML_PATH: {}'.format(self.XML_path))
 
         print("Writing: {}".format(self.XML_path))
         STIG_name = os.path.basename(self.stig_path)
-        ET.register_namespace("cdf", "http://checklists.nist.gov/xccdf/1.2")
-        self.tr = ET.Element("{http://checklists.nist.gov/xccdf/1.2}TestResult")
-        self.tr.set(
-            "id",
-            "xccdf_mil.disa.stig_testresult_scap_mil.disa_comp_{}".format(STIG_name),
-        )
+        ET.register_namespace('cdf', 'http://checklists.nist.gov/xccdf/1.2')
+        self.tr = ET.Element('{http://checklists.nist.gov/xccdf/1.2}TestResult')
+        self.tr.set('id', 'xccdf_mil.disa.stig_testresult_scap_mil.disa_comp_{}'.format(STIG_name))
         endtime = strftime("%Y-%m-%dT%H:%M:%S", gmtime())
-        self.tr.set("end-time", endtime)
-        tg = ET.SubElement(self.tr, "{http://checklists.nist.gov/xccdf/1.2}target")
+        self.tr.set('end-time', endtime)
+        tg = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}target')
         tg.text = platform.node()
 
     def _get_rev(self, nid):
-        with open(self.stig_path, "r") as f:
-            r = "SV-{}r(?P<rev>\d+)_rule".format(nid)
+        with open(self.stig_path, 'r') as f:
+            r = 'SV-{}r(?P<rev>\d+)_rule'.format(nid)
             m = re.search(r, f.read())
         if m:
-            rev = m.group("rev")
+            rev = m.group('rev')
         else:
-            rev = "0"
+            rev = '0'
         return rev
 
     def v2_runner_on_ok(self, result):
         name = result._task.get_name()
-        m = re.search("stigrule_(?P<id>\d+)", name)
+        m = re.search('stigrule_(?P<id>\d+)', name)
         if m:
-            nid = m.group("id")
+            nid = m.group('id')
         else:
             return
         rev = self._get_rev(nid)
         key = "{}r{}".format(nid, rev)
-        if self.rules.get(key, "Unknown") != False:
+        if self.rules.get(key, 'Unknown') != False:
             self.rules[key] = result.is_changed()
 
     def v2_playbook_on_stats(self, stats):
         for rule, changed in self.rules.items():
-            state = "fail" if changed else "pass"
-            rr = ET.SubElement(
-                self.tr, "{http://checklists.nist.gov/xccdf/1.2}rule-result"
-            )
-            rr.set("idref", "xccdf_mil.disa.stig_rule_SV-{}_rule".format(rule))
-            rs = ET.SubElement(rr, "{http://checklists.nist.gov/xccdf/1.2}result")
+            state = 'fail' if changed else 'pass'
+            rr = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}rule-result')
+            rr.set('idref', 'xccdf_mil.disa.stig_rule_SV-{}_rule'.format(rule))
+            rs = ET.SubElement(rr, '{http://checklists.nist.gov/xccdf/1.2}result')
             rs.text = state
         passing = len(self.rules) - sum(self.rules.values())
-        sc = ET.SubElement(self.tr, "{http://checklists.nist.gov/xccdf/1.2}score")
-        sc.set("maximum", str(len(self.rules)))
-        sc.set("system", "urn:xccdf:scoring:flat-unweighted")
+        sc = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}score')
+        sc.set('maximum', str(len(self.rules)))
+        sc.set('system', 'urn:xccdf:scoring:flat-unweighted')
         sc.text = str(passing)
-        with open(self.XML_path, "wb") as f:
+        with open(self.XML_path, 'wb') as f:
             out = ET.tostring(self.tr)
-            pretty = xml.dom.minidom.parseString(out).toprettyxml(encoding="utf-8")
+            pretty = xml.dom.minidom.parseString(out).toprettyxml(encoding='utf-8')
             f.write(pretty)

collections/ansible_collections/demo/compliance/roles/rhel8STIG/defaults/main.yml

@@ -3,7 +3,7 @@ rhel8STIG_stigrule_230225_Manage: True
 rhel8STIG_stigrule_230225_banner_Line: banner /etc/issue
 # R-230226 RHEL-08-010050
 rhel8STIG_stigrule_230226_Manage: True
-rhel8STIG_stigrule_230226__etc_dconf_db_local_d_01_banner_message_Value: '''You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'''
+rhel8STIG_stigrule_230226__etc_dconf_db_local_d_01_banner_message_Value: "''You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.''"
 # R-230227 RHEL-08-010060
 rhel8STIG_stigrule_230227_Manage: True
 rhel8STIG_stigrule_230227__etc_issue_Dest: /etc/issue
@@ -43,9 +43,6 @@ rhel8STIG_stigrule_230241_policycoreutils_State: installed
 # R-230244 RHEL-08-010200
 rhel8STIG_stigrule_230244_Manage: True
 rhel8STIG_stigrule_230244_ClientAliveCountMax_Line: ClientAliveCountMax 1
-# R-230252 RHEL-08-010291
-rhel8STIG_stigrule_230252_Manage: True
-rhel8STIG_stigrule_230252__etc_sysconfig_sshd_Line: '# CRYPTO_POLICY='
 # R-230255 RHEL-08-010294
 rhel8STIG_stigrule_230255_Manage: True
 rhel8STIG_stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config_Line: 'MinProtocol = TLSv1.2'
@@ -138,19 +135,9 @@ rhel8STIG_stigrule_230346__etc_security_limits_conf_Line: '* hard maxlogins 10'
 # R-230347 RHEL-08-020030
 rhel8STIG_stigrule_230347_Manage: True
 rhel8STIG_stigrule_230347__etc_dconf_db_local_d_00_screensaver_Value: 'true'
-# R-230348 RHEL-08-020040
-rhel8STIG_stigrule_230348_Manage: True
-rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State: installed
-rhel8STIG_stigrule_230348__etc_tmux_conf_Line: 'set -g lock-command vlock'
-# R-230349 RHEL-08-020041
-rhel8STIG_stigrule_230349_Manage: True
-rhel8STIG_stigrule_230349__etc_bashrc_Line: '[ -n "$PS1" -a -z "$TMUX" ] && exec tmux'
 # R-230352 RHEL-08-020060
 rhel8STIG_stigrule_230352_Manage: True
 rhel8STIG_stigrule_230352__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 900'
-# R-230353 RHEL-08-020070
-rhel8STIG_stigrule_230353_Manage: True
-rhel8STIG_stigrule_230353__etc_tmux_conf_Line: 'set -g lock-after-time 900'
 # R-230354 RHEL-08-020080
 rhel8STIG_stigrule_230354_Manage: True
 rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line: '/org/gnome/desktop/screensaver/lock-delay'
@@ -232,9 +219,6 @@ rhel8STIG_stigrule_230394__etc_audit_auditd_conf_Line: 'name_format = hostname'
 # R-230395 RHEL-08-030063
 rhel8STIG_stigrule_230395_Manage: True
 rhel8STIG_stigrule_230395__etc_audit_auditd_conf_Line: 'log_format = ENRICHED'
-# R-230396 RHEL-08-030070
-rhel8STIG_stigrule_230396_Manage: True
-rhel8STIG_stigrule_230396__etc_audit_auditd_conf_Line: 'log_group = root'
 # R-230398 RHEL-08-030090
 # A duplicate of 230396
 # duplicate of 230396
@@ -341,8 +325,8 @@ rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32_Line: '
 rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64_Line: '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
 # R-230439 RHEL-08-030361
 rhel8STIG_stigrule_230439_Manage: True
-rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=unset -k module_chng'
-rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=unset -k module_chng'
+rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
+rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
 # R-230444 RHEL-08-030370
 rhel8STIG_stigrule_230444_Manage: True
 rhel8STIG_stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd_Line: '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'
@@ -438,7 +422,8 @@ rhel8STIG_stigrule_230527_Manage: True
 rhel8STIG_stigrule_230527_RekeyLimit_Line: RekeyLimit 1G 1h
 # R-230529 RHEL-08-040170
 rhel8STIG_stigrule_230529_Manage: True
-rhel8STIG_stigrule_230529_systemctl_mask_ctrl_alt_del_target_Command: systemctl mask ctrl-alt-del.target
+rhel8STIG_stigrule_230529_ctrl_alt_del_target_disable_Enabled: false
+rhel8STIG_stigrule_230529_ctrl_alt_del_target_mask_Masked: true
 # R-230531 RHEL-08-040172
 rhel8STIG_stigrule_230531_Manage: True
 rhel8STIG_stigrule_230531__etc_systemd_system_conf_Value: 'none'
@@ -520,6 +505,9 @@ rhel8STIG_stigrule_244523__usr_lib_systemd_system_emergency_service_Value: '-/us
 # R-244525 RHEL-08-010201
 rhel8STIG_stigrule_244525_Manage: True
 rhel8STIG_stigrule_244525_ClientAliveInterval_Line: ClientAliveInterval 600
+# R-244526 RHEL-08-010287
+rhel8STIG_stigrule_244526_Manage: True
+rhel8STIG_stigrule_244526__etc_sysconfig_sshd_Line: '# CRYPTO_POLICY='
 # R-244527 RHEL-08-010472
 rhel8STIG_stigrule_244527_Manage: True
 rhel8STIG_stigrule_244527_rng_tools_State: installed
@@ -532,9 +520,6 @@ rhel8STIG_stigrule_244535__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 5'
 # R-244536 RHEL-08-020032
 rhel8STIG_stigrule_244536_Manage: True
 rhel8STIG_stigrule_244536__etc_dconf_db_local_d_02_login_screen_Value: 'true'
-# R-244537 RHEL-08-020039
-rhel8STIG_stigrule_244537_Manage: True
-rhel8STIG_stigrule_244537_tmux_State: installed
 # R-244538 RHEL-08-020081
 rhel8STIG_stigrule_244538_Manage: True
 rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line: '/org/gnome/desktop/session/idle-delay'
@@ -569,3 +554,6 @@ rhel8STIG_stigrule_244553_net_ipv4_conf_all_accept_redirects_Value: 0
 # R-244554 RHEL-08-040286
 rhel8STIG_stigrule_244554_Manage: True
 rhel8STIG_stigrule_244554__etc_sysctl_d_99_sysctl_conf_Line: 'net.core.bpf_jit_harden = 2'
+# R-256974 RHEL-08-010358
+rhel8STIG_stigrule_256974_Manage: True
+rhel8STIG_stigrule_256974_mailx_State: installed

collections/ansible_collections/demo/compliance/roles/rhel8STIG/handlers/main.yml

@@ -6,6 +6,25 @@
   service:
     name: sshd
     state: restarted
+- name: rsyslog_restart
+  service:
+    name: rsyslog
+    state: restarted
+- name: sysctl_load_settings
+  command: sysctl --system
+- name: daemon_reload
+  systemd:
+    daemon_reload: true
+- name: networkmanager_reload
+  service:
+    name: NetworkManager
+    state: reloaded
+- name: logind_restart
+  service:
+    name: systemd-logind
+    state: restarted
+- name: with_faillock_enable
+  command: authselect enable-feature with-faillock
 - name: do_reboot
   reboot:
     pre_reboot_delay: 60

collections/ansible_collections/demo/compliance/roles/rhel8STIG/tasks/main.yml

@@ -4,7 +4,7 @@
 - name: stigrule_230225_banner
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)banner\s+'
+    regexp: '(?i)^\s*banner\s+'
     line: "{{ rhel8STIG_stigrule_230225_banner_Line }}"
   notify: ssh_restart
   when:
@@ -82,22 +82,12 @@
 - name: stigrule_230244_ClientAliveCountMax
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)ClientAliveCountMax\s+'
+    regexp: '(?i)^\s*ClientAliveCountMax\s+'
     line: "{{ rhel8STIG_stigrule_230244_ClientAliveCountMax_Line }}"
   notify: ssh_restart
   when:
     - rhel8STIG_stigrule_230244_Manage
     - "'openssh-server' in packages"
-# R-230252 RHEL-08-010291
-- name: stigrule_230252__etc_sysconfig_sshd
-  lineinfile:
-    path: /etc/sysconfig/sshd
-    regexp: '^# CRYPTO_POLICY='
-    line: "{{ rhel8STIG_stigrule_230252__etc_sysconfig_sshd_Line }}"
-    create: yes
-  notify: do_reboot
-  when:
-    - rhel8STIG_stigrule_230252_Manage
 # R-230255 RHEL-08-010294
 - name: stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config
   lineinfile:
@@ -111,6 +101,7 @@
 - name: stigrule_230256__etc_crypto_policies_back_ends_gnutls_config
   lineinfile:
     path: /etc/crypto-policies/back-ends/gnutls.config
+    regexp: '^\+VERS'
     line: "{{ rhel8STIG_stigrule_230256__etc_crypto_policies_back_ends_gnutls_config_Line }}"
     create: yes
   when:
@@ -249,7 +240,7 @@
 - name: stigrule_230288_StrictModes
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)StrictModes\s+'
+    regexp: '(?i)^\s*StrictModes\s+'
     line: "{{ rhel8STIG_stigrule_230288_StrictModes_Line }}"
   notify: ssh_restart
   when:
@@ -259,7 +250,7 @@
 - name: stigrule_230290_IgnoreUserKnownHosts
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)IgnoreUserKnownHosts\s+'
+    regexp: '(?i)^\s*IgnoreUserKnownHosts\s+'
     line: "{{ rhel8STIG_stigrule_230290_IgnoreUserKnownHosts_Line }}"
   notify: ssh_restart
   when:
@@ -269,7 +260,7 @@
 - name: stigrule_230291_KerberosAuthentication
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)KerberosAuthentication\s+'
+    regexp: '(?i)^\s*KerberosAuthentication\s+'
     line: "{{ rhel8STIG_stigrule_230291_KerberosAuthentication_Line }}"
   notify: ssh_restart
   when:
@@ -279,7 +270,7 @@
 - name: stigrule_230296_PermitRootLogin
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)PermitRootLogin\s+'
+    regexp: '(?i)^\s*PermitRootLogin\s+'
     line: "{{ rhel8STIG_stigrule_230296_PermitRootLogin_Line }}"
   notify: ssh_restart
   when:
@@ -395,7 +386,7 @@
 - name: stigrule_230330_PermitUserEnvironment
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)PermitUserEnvironment\s+'
+    regexp: '(?i)^\s*PermitUserEnvironment\s+'
     line: "{{ rhel8STIG_stigrule_230330_PermitUserEnvironment_Line }}"
   notify: ssh_restart
   when:
@@ -422,28 +413,6 @@
   when:
     - rhel8STIG_stigrule_230347_Manage
     - "'dconf' in packages"
-# R-230348 RHEL-08-020040
-- name: stigrule_230348_ensure_tmux_is_installed
-  yum:
-    name: tmux
-    state: "{{ rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State }}"
-  when: rhel8STIG_stigrule_230348_Manage
-# R-230348 RHEL-08-020040
-- name: stigrule_230348__etc_tmux_conf
-  lineinfile:
-    path: /etc/tmux.conf
-    line: "{{ rhel8STIG_stigrule_230348__etc_tmux_conf_Line }}"
-    create: yes
-  when:
-    - rhel8STIG_stigrule_230348_Manage
-# R-230349 RHEL-08-020041
-- name: stigrule_230349__etc_bashrc
-  lineinfile:
-    path: /etc/bashrc
-    line: "{{ rhel8STIG_stigrule_230349__etc_bashrc_Line }}"
-    create: yes
-  when:
-    - rhel8STIG_stigrule_230349_Manage
 # R-230352 RHEL-08-020060
 - name: stigrule_230352__etc_dconf_db_local_d_00_screensaver
   ini_file:
@@ -456,20 +425,13 @@
   when:
     - rhel8STIG_stigrule_230352_Manage
     - "'dconf' in packages"
-# R-230353 RHEL-08-020070
-- name: stigrule_230353__etc_tmux_conf
-  lineinfile:
-    path: /etc/tmux.conf
-    line: "{{ rhel8STIG_stigrule_230353__etc_tmux_conf_Line }}"
-    create: yes
-  when:
-    - rhel8STIG_stigrule_230353_Manage
 # R-230354 RHEL-08-020080
 - name: stigrule_230354__etc_dconf_db_local_d_locks_session
   lineinfile:
     path: /etc/dconf/db/local.d/locks/session
     line: "{{ rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line }}"
     create: yes
+  notify: dconf_update
   when:
     - rhel8STIG_stigrule_230354_Manage
 # R-230357 RHEL-08-020110
@@ -602,7 +564,7 @@
 - name: stigrule_230382_PrintLastLog
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)PrintLastLog\s+'
+    regexp: '(?i)^\s*PrintLastLog\s+'
     line: "{{ rhel8STIG_stigrule_230382_PrintLastLog_Line }}"
   notify: ssh_restart
   when:
@@ -618,7 +580,7 @@
   when:
     - rhel8STIG_stigrule_230383_Manage
 # R-230386 RHEL-08-030000
-- name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b32
+- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv$'
@@ -626,7 +588,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230386_Manage
 # R-230386 RHEL-08-030000
-- name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b64
+- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv$'
@@ -634,7 +596,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230386_Manage
 # R-230386 RHEL-08-030000
-- name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b32
+- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv$'
@@ -642,7 +604,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230386_Manage
 # R-230386 RHEL-08-030000
-- name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b64
+- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv$'
@@ -726,18 +688,8 @@
   notify: auditd_restart
   when:
     - rhel8STIG_stigrule_230395_Manage
-# R-230396 RHEL-08-030070
-- name: stigrule_230396__etc_audit_auditd_conf
-  lineinfile:
-    path: /etc/audit/auditd.conf
-    regexp: '^log_group = '
-    line: "{{ rhel8STIG_stigrule_230396__etc_audit_auditd_conf_Line }}"
-    create: yes
-  notify: auditd_restart
-  when:
-    - rhel8STIG_stigrule_230396_Manage
 # R-230402 RHEL-08-030121
-- name : stigrule_230402__etc_audit_rules_d_audit_rules_e2
+- name: stigrule_230402__etc_audit_rules_d_audit_rules_e2
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-e 2$'
@@ -745,7 +697,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230402_Manage
 # R-230403 RHEL-08-030122
-- name : stigrule_230403__etc_audit_rules_d_audit_rules_loginuid_immutable
+- name: stigrule_230403__etc_audit_rules_d_audit_rules_loginuid_immutable
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^--loginuid-immutable$'
@@ -753,7 +705,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230403_Manage
 # R-230404 RHEL-08-030130
-- name : stigrule_230404__etc_audit_rules_d_audit_rules__etc_shadow
+- name: stigrule_230404__etc_audit_rules_d_audit_rules__etc_shadow
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/shadow -p wa -k identity$'
@@ -761,7 +713,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230404_Manage
 # R-230405 RHEL-08-030140
-- name : stigrule_230405__etc_audit_rules_d_audit_rules__etc_security_opasswd
+- name: stigrule_230405__etc_audit_rules_d_audit_rules__etc_security_opasswd
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/security/opasswd -p wa -k identity$'
@@ -769,7 +721,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230405_Manage
 # R-230406 RHEL-08-030150
-- name : stigrule_230406__etc_audit_rules_d_audit_rules__etc_passwd
+- name: stigrule_230406__etc_audit_rules_d_audit_rules__etc_passwd
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/passwd -p wa -k identity$'
@@ -777,7 +729,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230406_Manage
 # R-230407 RHEL-08-030160
-- name : stigrule_230407__etc_audit_rules_d_audit_rules__etc_gshadow
+- name: stigrule_230407__etc_audit_rules_d_audit_rules__etc_gshadow
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/gshadow -p wa -k identity$'
@@ -785,7 +737,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230407_Manage
 # R-230408 RHEL-08-030170
-- name : stigrule_230408__etc_audit_rules_d_audit_rules__etc_group
+- name: stigrule_230408__etc_audit_rules_d_audit_rules__etc_group
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/group -p wa -k identity$'
@@ -793,7 +745,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230408_Manage
 # R-230409 RHEL-08-030171
-- name : stigrule_230409__etc_audit_rules_d_audit_rules__etc_sudoers
+- name: stigrule_230409__etc_audit_rules_d_audit_rules__etc_sudoers
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/sudoers -p wa -k identity$'
@@ -801,7 +753,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230409_Manage
 # R-230410 RHEL-08-030172
-- name : stigrule_230410__etc_audit_rules_d_audit_rules__etc_sudoers_d_
+- name: stigrule_230410__etc_audit_rules_d_audit_rules__etc_sudoers_d_
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /etc/sudoers.d/ -p wa -k identity$'
@@ -815,7 +767,7 @@
     state: "{{ rhel8STIG_stigrule_230411_audit_State }}"
   when: rhel8STIG_stigrule_230411_Manage
 # R-230412 RHEL-08-030190
-- name : stigrule_230412__etc_audit_rules_d_audit_rules__usr_bin_su
+- name: stigrule_230412__etc_audit_rules_d_audit_rules__usr_bin_su
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change$'
@@ -823,7 +775,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230412_Manage
 # R-230413 RHEL-08-030200
-- name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset
+- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -831,7 +783,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230413_Manage
 # R-230413 RHEL-08-030200
-- name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset
+- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -839,7 +791,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230413_Manage
 # R-230413 RHEL-08-030200
-- name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32
+- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$'
@@ -847,7 +799,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230413_Manage
 # R-230413 RHEL-08-030200
-- name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64
+- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$'
@@ -855,7 +807,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230413_Manage
 # R-230418 RHEL-08-030250
-- name : stigrule_230418__etc_audit_rules_d_audit_rules__usr_bin_chage
+- name: stigrule_230418__etc_audit_rules_d_audit_rules__usr_bin_chage
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage$'
@@ -863,7 +815,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230418_Manage
 # R-230419 RHEL-08-030260
-- name : stigrule_230419__etc_audit_rules_d_audit_rules__usr_bin_chcon
+- name: stigrule_230419__etc_audit_rules_d_audit_rules__usr_bin_chcon
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -871,7 +823,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230419_Manage
 # R-230421 RHEL-08-030280
-- name : stigrule_230421__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent
+- name: stigrule_230421__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$'
@@ -879,7 +831,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230421_Manage
 # R-230422 RHEL-08-030290
-- name : stigrule_230422__etc_audit_rules_d_audit_rules__usr_bin_passwd
+- name: stigrule_230422__etc_audit_rules_d_audit_rules__usr_bin_passwd
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd$'
@@ -887,7 +839,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230422_Manage
 # R-230423 RHEL-08-030300
-- name : stigrule_230423__etc_audit_rules_d_audit_rules__usr_bin_mount
+- name: stigrule_230423__etc_audit_rules_d_audit_rules__usr_bin_mount
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -895,7 +847,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230423_Manage
 # R-230424 RHEL-08-030301
-- name : stigrule_230424__etc_audit_rules_d_audit_rules__usr_bin_umount
+- name: stigrule_230424__etc_audit_rules_d_audit_rules__usr_bin_umount
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -903,7 +855,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230424_Manage
 # R-230425 RHEL-08-030302
-- name : stigrule_230425__etc_audit_rules_d_audit_rules_mount_b32
+- name: stigrule_230425__etc_audit_rules_d_audit_rules_mount_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -911,7 +863,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230425_Manage
 # R-230425 RHEL-08-030302
-- name : stigrule_230425__etc_audit_rules_d_audit_rules_mount_b64
+- name: stigrule_230425__etc_audit_rules_d_audit_rules_mount_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -919,7 +871,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230425_Manage
 # R-230426 RHEL-08-030310
-- name : stigrule_230426__etc_audit_rules_d_audit_rules__usr_sbin_unix_update
+- name: stigrule_230426__etc_audit_rules_d_audit_rules__usr_sbin_unix_update
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -927,7 +879,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230426_Manage
 # R-230427 RHEL-08-030311
-- name : stigrule_230427__etc_audit_rules_d_audit_rules__usr_sbin_postdrop
+- name: stigrule_230427__etc_audit_rules_d_audit_rules__usr_sbin_postdrop
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -935,7 +887,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230427_Manage
 # R-230428 RHEL-08-030312
-- name : stigrule_230428__etc_audit_rules_d_audit_rules__usr_sbin_postqueue
+- name: stigrule_230428__etc_audit_rules_d_audit_rules__usr_sbin_postqueue
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -943,7 +895,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230428_Manage
 # R-230429 RHEL-08-030313
-- name : stigrule_230429__etc_audit_rules_d_audit_rules__usr_sbin_semanage
+- name: stigrule_230429__etc_audit_rules_d_audit_rules__usr_sbin_semanage
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -951,7 +903,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230429_Manage
 # R-230430 RHEL-08-030314
-- name : stigrule_230430__etc_audit_rules_d_audit_rules__usr_sbin_setfiles
+- name: stigrule_230430__etc_audit_rules_d_audit_rules__usr_sbin_setfiles
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -959,7 +911,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230430_Manage
 # R-230431 RHEL-08-030315
-- name : stigrule_230431__etc_audit_rules_d_audit_rules__usr_sbin_userhelper
+- name: stigrule_230431__etc_audit_rules_d_audit_rules__usr_sbin_userhelper
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -967,7 +919,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230431_Manage
 # R-230432 RHEL-08-030316
-- name : stigrule_230432__etc_audit_rules_d_audit_rules__usr_sbin_setsebool
+- name: stigrule_230432__etc_audit_rules_d_audit_rules__usr_sbin_setsebool
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -975,7 +927,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230432_Manage
 # R-230433 RHEL-08-030317
-- name : stigrule_230433__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd
+- name: stigrule_230433__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -983,7 +935,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230433_Manage
 # R-230434 RHEL-08-030320
-- name : stigrule_230434__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign
+- name: stigrule_230434__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$'
@@ -991,7 +943,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230434_Manage
 # R-230435 RHEL-08-030330
-- name : stigrule_230435__etc_audit_rules_d_audit_rules__usr_bin_setfacl
+- name: stigrule_230435__etc_audit_rules_d_audit_rules__usr_bin_setfacl
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -999,7 +951,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230435_Manage
 # R-230436 RHEL-08-030340
-- name : stigrule_230436__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check
+- name: stigrule_230436__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check$'
@@ -1007,7 +959,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230436_Manage
 # R-230437 RHEL-08-030350
-- name : stigrule_230437__etc_audit_rules_d_audit_rules__usr_bin_newgrp
+- name: stigrule_230437__etc_audit_rules_d_audit_rules__usr_bin_newgrp
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -1015,7 +967,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230437_Manage
 # R-230438 RHEL-08-030360
-- name : stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32
+- name: stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -1023,7 +975,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230438_Manage
 # R-230438 RHEL-08-030360
-- name : stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64
+- name: stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -1031,23 +983,23 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230438_Manage
 # R-230439 RHEL-08-030361
-- name : stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32
+- name: stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
-    regexp: '^-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=unset -k module_chng$'
+    regexp: '^-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$'
     line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line }}"
   notify: auditd_restart
   when: rhel8STIG_stigrule_230439_Manage
 # R-230439 RHEL-08-030361
-- name : stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64
+- name: stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
-    regexp: '^-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=unset -k module_chng$'
+    regexp: '^-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$'
     line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line }}"
   notify: auditd_restart
   when: rhel8STIG_stigrule_230439_Manage
 # R-230444 RHEL-08-030370
-- name : stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd
+- name: stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd$'
@@ -1055,7 +1007,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230444_Manage
 # R-230446 RHEL-08-030390
-- name : stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b32
+- name: stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -1063,7 +1015,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230446_Manage
 # R-230446 RHEL-08-030390
-- name : stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b64
+- name: stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -1071,7 +1023,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230446_Manage
 # R-230447 RHEL-08-030400
-- name : stigrule_230447__etc_audit_rules_d_audit_rules__usr_bin_crontab
+- name: stigrule_230447__etc_audit_rules_d_audit_rules__usr_bin_crontab
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab$'
@@ -1079,7 +1031,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230447_Manage
 # R-230448 RHEL-08-030410
-- name : stigrule_230448__etc_audit_rules_d_audit_rules__usr_bin_chsh
+- name: stigrule_230448__etc_audit_rules_d_audit_rules__usr_bin_chsh
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -1087,7 +1039,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230448_Manage
 # R-230449 RHEL-08-030420
-- name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b32
+- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1095,7 +1047,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230449_Manage
 # R-230449 RHEL-08-030420
-- name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b64
+- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1103,7 +1055,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230449_Manage
 # R-230449 RHEL-08-030420
-- name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b32
+- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1111,7 +1063,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230449_Manage
 # R-230449 RHEL-08-030420
-- name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b64
+- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1119,7 +1071,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230449_Manage
 # R-230455 RHEL-08-030480
-- name : stigrule_230455__etc_audit_rules_d_audit_rules_chown_b32
+- name: stigrule_230455__etc_audit_rules_d_audit_rules_chown_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1127,7 +1079,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230455_Manage
 # R-230455 RHEL-08-030480
-- name : stigrule_230455__etc_audit_rules_d_audit_rules_chown_b64
+- name: stigrule_230455__etc_audit_rules_d_audit_rules_chown_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1135,7 +1087,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230455_Manage
 # R-230456 RHEL-08-030490
-- name : stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b32
+- name: stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b32
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1143,7 +1095,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230456_Manage
 # R-230456 RHEL-08-030490
-- name : stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b64
+- name: stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b64
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1151,7 +1103,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230456_Manage
 # R-230462 RHEL-08-030550
-- name : stigrule_230462__etc_audit_rules_d_audit_rules__usr_bin_sudo
+- name: stigrule_230462__etc_audit_rules_d_audit_rules__usr_bin_sudo
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -1159,7 +1111,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230462_Manage
 # R-230463 RHEL-08-030560
-- name : stigrule_230463__etc_audit_rules_d_audit_rules__usr_sbin_usermod
+- name: stigrule_230463__etc_audit_rules_d_audit_rules__usr_sbin_usermod
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod$'
@@ -1167,7 +1119,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230463_Manage
 # R-230464 RHEL-08-030570
-- name : stigrule_230464__etc_audit_rules_d_audit_rules__usr_bin_chacl
+- name: stigrule_230464__etc_audit_rules_d_audit_rules__usr_bin_chacl
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1175,7 +1127,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230464_Manage
 # R-230465 RHEL-08-030580
-- name : stigrule_230465__etc_audit_rules_d_audit_rules__usr_bin_kmod
+- name: stigrule_230465__etc_audit_rules_d_audit_rules__usr_bin_kmod
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules$'
@@ -1183,7 +1135,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230465_Manage
 # R-230466 RHEL-08-030590
-- name : stigrule_230466__etc_audit_rules_d_audit_rules__var_log_faillock
+- name: stigrule_230466__etc_audit_rules_d_audit_rules__var_log_faillock
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /var/log/faillock -p wa -k logins$'
@@ -1191,7 +1143,7 @@
   notify: auditd_restart
   when: rhel8STIG_stigrule_230466_Manage
 # R-230467 RHEL-08-030600
-- name : stigrule_230467__etc_audit_rules_d_audit_rules__var_log_lastlog
+- name: stigrule_230467__etc_audit_rules_d_audit_rules__var_log_lastlog
   lineinfile:
     path: /etc/audit/rules.d/audit.rules
     regexp: '^-w /var/log/lastlog -p wa -k logins$'
@@ -1314,7 +1266,7 @@
   when: rhel8STIG_stigrule_230505_Manage
 # R-230506 RHEL-08-040110
 - name: check if wireless network adapters are disabled
-  shell: "[[ $(nmcli radio wifi)  == 'enabled' ]]"
+  shell: "[[ $(nmcli radio wifi) == 'enabled' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1348,20 +1300,40 @@
 - name: stigrule_230527_RekeyLimit
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)RekeyLimit\s+'
+    regexp: '(?i)^\s*RekeyLimit\s+'
     line: "{{ rhel8STIG_stigrule_230527_RekeyLimit_Line }}"
   notify: ssh_restart
   when:
     - rhel8STIG_stigrule_230527_Manage
     - "'openssh-server' in packages"
 # R-230529 RHEL-08-040170
-- name: stigrule_230529_systemctl_mask_ctrl_alt_del_target
-  systemd:
+- name: check if ctrl-alt-del.target is installed
+  shell: ! systemctl list-unit-files | grep "^ctrl-alt-del.target[ \t]\+"
+  changed_when: False
+  check_mode: no
+  register: result
+  failed_when: result.rc > 1
+- name: stigrule_230529_ctrl_alt_del_target_disable
+  systemd_service:
     name: ctrl-alt-del.target
-    enabled: no
-    masked: yes
+    enabled: "{{ rhel8STIG_stigrule_230529_ctrl_alt_del_target_disable_Enabled }}"
   when:
     - rhel8STIG_stigrule_230529_Manage
+    - result.rc == 0
+# R-230529 RHEL-08-040170
+- name: check if ctrl-alt-del.target is installed
+  shell: ! systemctl list-unit-files | grep "^ctrl-alt-del.target[ \t]\+"
+  changed_when: False
+  check_mode: no
+  register: result
+  failed_when: result.rc > 1
+- name: stigrule_230529_ctrl_alt_del_target_mask
+  systemd_service:
+    name: ctrl-alt-del.target
+    masked: "{{ rhel8STIG_stigrule_230529_ctrl_alt_del_target_mask_Masked }}"
+  when:
+    - rhel8STIG_stigrule_230529_Manage
+    - result.rc == 0
 # R-230531 RHEL-08-040172
 - name: stigrule_230531__etc_systemd_system_conf
   ini_file:
@@ -1382,7 +1354,7 @@
   when: rhel8STIG_stigrule_230533_Manage
 # R-230535 RHEL-08-040210
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1410,7 +1382,7 @@
     - rhel8STIG_stigrule_230537_Manage
 # R-230538 RHEL-08-040240
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1424,7 +1396,7 @@
     - cmd_result.rc == 0
 # R-230539 RHEL-08-040250
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1445,7 +1417,7 @@
     - rhel8STIG_stigrule_230540_Manage
 # R-230540 RHEL-08-040260
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1459,7 +1431,7 @@
     - cmd_result.rc == 0
 # R-230541 RHEL-08-040261
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1473,7 +1445,7 @@
     - cmd_result.rc == 0
 # R-230542 RHEL-08-040262
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1494,7 +1466,7 @@
     - rhel8STIG_stigrule_230543_Manage
 # R-230544 RHEL-08-040280
 - name: check if ipv6 is enabled
-  shell: "[[ $(cat /sys/module/ipv6/parameters/disable)  == '0' ]]"
+  shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
   changed_when: False
   check_mode: no
   register: cmd_result
@@ -1569,7 +1541,7 @@
 - name: stigrule_230555_X11Forwarding
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)X11Forwarding\s+'
+    regexp: '(?i)^\s*X11Forwarding\s+'
     line: "{{ rhel8STIG_stigrule_230555_X11Forwarding_Line }}"
   notify: ssh_restart
   when:
@@ -1579,7 +1551,7 @@
 - name: stigrule_230556_X11UseLocalhost
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)X11UseLocalhost\s+'
+    regexp: '(?i)^\s*X11UseLocalhost\s+'
     line: "{{ rhel8STIG_stigrule_230556_X11UseLocalhost_Line }}"
   notify: ssh_restart
   when:
@@ -1635,12 +1607,22 @@
 - name: stigrule_244525_ClientAliveInterval
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)ClientAliveInterval\s+'
+    regexp: '(?i)^\s*ClientAliveInterval\s+'
     line: "{{ rhel8STIG_stigrule_244525_ClientAliveInterval_Line }}"
   notify: ssh_restart
   when:
     - rhel8STIG_stigrule_244525_Manage
     - "'openssh-server' in packages"
+# R-244526 RHEL-08-010287
+- name: stigrule_244526__etc_sysconfig_sshd
+  lineinfile:
+    path: /etc/sysconfig/sshd
+    regexp: '^# CRYPTO_POLICY='
+    line: "{{ rhel8STIG_stigrule_244526__etc_sysconfig_sshd_Line }}"
+    create: yes
+  notify: do_reboot
+  when:
+    - rhel8STIG_stigrule_244526_Manage
 # R-244527 RHEL-08-010472
 - name: stigrule_244527_rng_tools
   yum:
@@ -1651,7 +1633,7 @@
 - name: stigrule_244528_GSSAPIAuthentication
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)GSSAPIAuthentication\s+'
+    regexp: '(?i)^\s*GSSAPIAuthentication\s+'
     line: "{{ rhel8STIG_stigrule_244528_GSSAPIAuthentication_Line }}"
   notify: ssh_restart
   when:
@@ -1681,18 +1663,13 @@
   when:
     - rhel8STIG_stigrule_244536_Manage
     - "'dconf' in packages"
-# R-244537 RHEL-08-020039
-- name: stigrule_244537_tmux
-  yum:
-    name: tmux
-    state: "{{ rhel8STIG_stigrule_244537_tmux_State }}"
-  when: rhel8STIG_stigrule_244537_Manage
 # R-244538 RHEL-08-020081
 - name: stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay
   lineinfile:
     path: /etc/dconf/db/local.d/locks/session
     line: "{{ rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line }}"
     create: yes
+  notify: dconf_update
   when:
     - rhel8STIG_stigrule_244538_Manage
 # R-244539 RHEL-08-020082
@@ -1701,6 +1678,7 @@
     path: /etc/dconf/db/local.d/locks/session
     line: "{{ rhel8STIG_stigrule_244539__etc_dconf_db_local_d_locks_session_lock_enabled_Line }}"
     create: yes
+  notify: dconf_update
   when:
     - rhel8STIG_stigrule_244539_Manage
 # R-244542 RHEL-08-030181
@@ -1798,3 +1776,9 @@
     create: yes
   when:
     - rhel8STIG_stigrule_244554_Manage
+# R-256974 RHEL-08-010358
+- name: stigrule_256974_mailx
+  yum:
+    name: mailx
+    state: "{{ rhel8STIG_stigrule_256974_mailx_State }}"
+  when: rhel8STIG_stigrule_256974_Manage

collections/ansible_collections/demo/compliance/roles/rhel9STIG/callback_plugins/stig_xml.py

@@ -0,0 +1,86 @@
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.plugins.callback import CallbackBase
+from time import gmtime, strftime
+import platform
+import tempfile
+import re
+import sys
+import os
+import xml.etree.ElementTree as ET
+import xml.dom.minidom
+
+class CallbackModule(CallbackBase):
+    CALLBACK_VERSION = 2.0
+    CALLBACK_TYPE = 'xml'
+    CALLBACK_NAME = 'stig_xml'
+
+    CALLBACK_NEEDS_WHITELIST = True
+
+    def _get_STIG_path(self):
+        cwd = os.path.abspath('.')
+        for dirpath, dirs, files in os.walk(cwd):
+            if os.path.sep + 'files' in dirpath and '.xml' in files[0]:
+                return os.path.join(cwd, dirpath, files[0])
+
+    def __init__(self):
+        super(CallbackModule, self).__init__()
+        self.rules = {}
+        self.stig_path = os.environ.get('STIG_PATH')
+        self.XML_path = os.environ.get('XML_PATH')
+        if self.stig_path is None:
+            self.stig_path = self._get_STIG_path()
+        self._display.display('Using STIG_PATH: {}'.format(self.stig_path))
+        if self.XML_path is None:
+            self.XML_path = tempfile.mkdtemp() + "/xccdf-results.xml"
+        self._display.display('Using XML_PATH: {}'.format(self.XML_path))
+
+        print("Writing: {}".format(self.XML_path))
+        STIG_name = os.path.basename(self.stig_path)
+        ET.register_namespace('cdf', 'http://checklists.nist.gov/xccdf/1.2')
+        self.tr = ET.Element('{http://checklists.nist.gov/xccdf/1.2}TestResult')
+        self.tr.set('id', 'xccdf_mil.disa.stig_testresult_scap_mil.disa_comp_{}'.format(STIG_name))
+        endtime = strftime("%Y-%m-%dT%H:%M:%S", gmtime())
+        self.tr.set('end-time', endtime)
+        tg = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}target')
+        tg.text = platform.node()
+
+    def _get_rev(self, nid):
+        with open(self.stig_path, 'r') as f:
+            r = 'SV-{}r(?P<rev>\d+)_rule'.format(nid)
+            m = re.search(r, f.read())
+        if m:
+            rev = m.group('rev')
+        else:
+            rev = '0'
+        return rev
+
+    def v2_runner_on_ok(self, result):
+        name = result._task.get_name()
+        m = re.search('stigrule_(?P<id>\d+)', name)
+        if m:
+            nid = m.group('id')
+        else:
+            return
+        rev = self._get_rev(nid)
+        key = "{}r{}".format(nid, rev)
+        if self.rules.get(key, 'Unknown') != False:
+            self.rules[key] = result.is_changed()
+
+    def v2_playbook_on_stats(self, stats):
+        for rule, changed in self.rules.items():
+            state = 'fail' if changed else 'pass'
+            rr = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}rule-result')
+            rr.set('idref', 'xccdf_mil.disa.stig_rule_SV-{}_rule'.format(rule))
+            rs = ET.SubElement(rr, '{http://checklists.nist.gov/xccdf/1.2}result')
+            rs.text = state
+        passing = len(self.rules) - sum(self.rules.values())
+        sc = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}score')
+        sc.set('maximum', str(len(self.rules)))
+        sc.set('system', 'urn:xccdf:scoring:flat-unweighted')
+        sc.text = str(passing)
+        with open(self.XML_path, 'wb') as f:
+            out = ET.tostring(self.tr)
+            pretty = xml.dom.minidom.parseString(out).toprettyxml(encoding='utf-8')
+            f.write(pretty)

collections/ansible_collections/demo/compliance/roles/rhel9STIG/defaults/main.yml

@@ -0,0 +1,984 @@
+# R-257779 RHEL-09-211020
+rhel9STIG_stigrule_257779_Manage: True
+rhel9STIG_stigrule_257779__etc_issue_Dest: /etc/issue
+rhel9STIG_stigrule_257779__etc_issue_Content: 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
+
+'
+# R-257783 RHEL-09-211040
+rhel9STIG_stigrule_257783_Manage: True
+rhel9STIG_stigrule_257783_systemd_journald_enable_Enabled: yes
+rhel9STIG_stigrule_257783_systemd_journald_start_State: started
+# R-257784 RHEL-09-211045
+rhel9STIG_stigrule_257784_Manage: True
+rhel9STIG_stigrule_257784__etc_systemd_system_conf_Value: 'none'
+# R-257785 RHEL-09-211050
+rhel9STIG_stigrule_257785_Manage: True
+rhel9STIG_stigrule_257785_ctrl_alt_del_target_disable_Enabled: false
+rhel9STIG_stigrule_257785_ctrl_alt_del_target_mask_Masked: true
+# R-257786 RHEL-09-211055
+rhel9STIG_stigrule_257786_Manage: True
+rhel9STIG_stigrule_257786_debug_shell_service_disable_Enabled: false
+rhel9STIG_stigrule_257786_debug_shell_service_mask_Masked: true
+# R-257790 RHEL-09-212025
+rhel9STIG_stigrule_257790_Manage: True
+rhel9STIG_stigrule_257790__boot_grub2_grub_cfg_group_owner_Dest: /boot/grub2/grub.cfg
+rhel9STIG_stigrule_257790__boot_grub2_grub_cfg_group_owner_Group: root
+# R-257791 RHEL-09-212030
+rhel9STIG_stigrule_257791_Manage: True
+rhel9STIG_stigrule_257791__boot_grub2_grub_cfg_owner_Dest: /boot/grub2/grub.cfg
+rhel9STIG_stigrule_257791__boot_grub2_grub_cfg_owner_Owner: root
+# R-257797 RHEL-09-213010
+rhel9STIG_stigrule_257797_Manage: True
+rhel9STIG_stigrule_257797_kernel_dmesg_restrict_Value: 1
+rhel9STIG_stigrule_257797_kernel_dmesg_restrict_File: /etc/sysctl.d/99-sysctl.conf
+# R-257798 RHEL-09-213015
+rhel9STIG_stigrule_257798_Manage: True
+rhel9STIG_stigrule_257798_kernel_perf_event_paranoid_Value: 2
+rhel9STIG_stigrule_257798_kernel_perf_event_paranoid_File: /etc/sysctl.d/99-sysctl.conf
+# R-257799 RHEL-09-213020
+rhel9STIG_stigrule_257799_Manage: True
+rhel9STIG_stigrule_257799_kernel_kexec_load_disabled_Value: 1
+rhel9STIG_stigrule_257799_kernel_kexec_load_disabled_File: /etc/sysctl.d/99-sysctl.conf
+# R-257800 RHEL-09-213025
+rhel9STIG_stigrule_257800_Manage: True
+rhel9STIG_stigrule_257800_kernel_kptr_restrict_Value: 1
+rhel9STIG_stigrule_257800_kernel_kptr_restrict_File: /etc/sysctl.d/99-sysctl.conf
+# R-257801 RHEL-09-213030
+rhel9STIG_stigrule_257801_Manage: True
+rhel9STIG_stigrule_257801_fs_protected_hardlinks_Value: 1
+rhel9STIG_stigrule_257801_fs_protected_hardlinks_File: /etc/sysctl.d/99-sysctl.conf
+# R-257802 RHEL-09-213035
+rhel9STIG_stigrule_257802_Manage: True
+rhel9STIG_stigrule_257802_fs_protected_symlinks_Value: 1
+rhel9STIG_stigrule_257802_fs_protected_symlinks_File: /etc/sysctl.d/99-sysctl.conf
+# R-257803 RHEL-09-213040
+rhel9STIG_stigrule_257803_Manage: True
+rhel9STIG_stigrule_257803_kernel_core_pattern_Value: '|/bin/false'
+rhel9STIG_stigrule_257803_kernel_core_pattern_File: /etc/sysctl.d/99-sysctl.conf
+# R-257804 RHEL-09-213045
+rhel9STIG_stigrule_257804_Manage: True
+rhel9STIG_stigrule_257804__etc_modprobe_d_atm_conf_install_atm__bin_false_Line: 'install atm /bin/false'
+rhel9STIG_stigrule_257804__etc_modprobe_d_atm_conf_blacklist_atm_Line: 'blacklist atm'
+# R-257805 RHEL-09-213050
+rhel9STIG_stigrule_257805_Manage: True
+rhel9STIG_stigrule_257805__etc_modprobe_d_can_conf_install_can__bin_false_Line: 'install can /bin/false'
+rhel9STIG_stigrule_257805__etc_modprobe_d_can_conf_blacklist_can_Line: 'blacklist can'
+# R-257806 RHEL-09-213055
+rhel9STIG_stigrule_257806_Manage: True
+rhel9STIG_stigrule_257806__etc_modprobe_d_firewire_core_conf_install_firewire_core__bin_false_Line: 'install firewire-core /bin/false'
+rhel9STIG_stigrule_257806__etc_modprobe_d_firewire_core_conf_blacklist_firewire_core_Line: 'blacklist firewire-core'
+# R-257807 RHEL-09-213060
+rhel9STIG_stigrule_257807_Manage: True
+rhel9STIG_stigrule_257807__etc_modprobe_d_sctp_conf_install_sctp__bin_false_Line: 'install sctp /bin/false'
+rhel9STIG_stigrule_257807__etc_modprobe_d_sctp_conf_blacklist_sctp_Line: 'blacklist sctp'
+# R-257808 RHEL-09-213065
+rhel9STIG_stigrule_257808_Manage: True
+rhel9STIG_stigrule_257808__etc_modprobe_d_tipc_conf_install_tipc__bin_false_Line: 'install tipc /bin/false'
+rhel9STIG_stigrule_257808__etc_modprobe_d_tipc_conf_blacklist_tipc_Line: 'blacklist tipc'
+# R-257809 RHEL-09-213070
+rhel9STIG_stigrule_257809_Manage: True
+rhel9STIG_stigrule_257809_kernel_randomize_va_space_Value: 2
+rhel9STIG_stigrule_257809_kernel_randomize_va_space_File: /etc/sysctl.d/99-sysctl.conf
+# R-257810 RHEL-09-213075
+rhel9STIG_stigrule_257810_Manage: True
+rhel9STIG_stigrule_257810_kernel_unprivileged_bpf_disabled_Value: 1
+rhel9STIG_stigrule_257810_kernel_unprivileged_bpf_disabled_File: /etc/sysctl.d/99-sysctl.conf
+# R-257811 RHEL-09-213080
+rhel9STIG_stigrule_257811_Manage: True
+rhel9STIG_stigrule_257811_kernel_yama_ptrace_scope_Value: 1
+rhel9STIG_stigrule_257811_kernel_yama_ptrace_scope_File: /etc/sysctl.d/99-sysctl.conf
+# R-257812 RHEL-09-213085
+rhel9STIG_stigrule_257812_Manage: True
+rhel9STIG_stigrule_257812__etc_systemd_coredump_conf_Line: 'ProcessSizeMax=0'
+# R-257813 RHEL-09-213090
+rhel9STIG_stigrule_257813_Manage: True
+rhel9STIG_stigrule_257813__etc_systemd_coredump_conf_Line: 'Storage=none'
+# R-257814 RHEL-09-213095
+rhel9STIG_stigrule_257814_Manage: True
+rhel9STIG_stigrule_257814__etc_security_limits_conf_Line: '* hard core 0'
+# R-257815 RHEL-09-213100
+rhel9STIG_stigrule_257815_Manage: True
+rhel9STIG_stigrule_257815_systemd_coredump_socket_disable_Enabled: false
+rhel9STIG_stigrule_257815_systemd_coredump_socket_mask_Daemon_Reload: true
+rhel9STIG_stigrule_257815_systemd_coredump_socket_mask_Masked: true
+# R-257816 RHEL-09-213105
+rhel9STIG_stigrule_257816_Manage: True
+rhel9STIG_stigrule_257816_user_max_user_namespaces_Value: 0
+rhel9STIG_stigrule_257816_user_max_user_namespaces_File: /etc/sysctl.d/99-sysctl.conf
+# R-257818 RHEL-09-213115
+rhel9STIG_stigrule_257818_Manage: True
+rhel9STIG_stigrule_257818_kdump_disable_Enabled: false
+rhel9STIG_stigrule_257818_kdump_mask_Masked: true
+# R-257820 RHEL-09-214015
+rhel9STIG_stigrule_257820_Manage: True
+rhel9STIG_stigrule_257820__etc_dnf_dnf_conf_Value: '1'
+# R-257821 RHEL-09-214020
+rhel9STIG_stigrule_257821_Manage: True
+rhel9STIG_stigrule_257821__etc_dnf_dnf_conf_Value: '1'
+# R-257824 RHEL-09-214035
+rhel9STIG_stigrule_257824_Manage: True
+rhel9STIG_stigrule_257824__etc_dnf_dnf_conf_Value: '1'
+# R-257825 RHEL-09-215010
+rhel9STIG_stigrule_257825_Manage: True
+rhel9STIG_stigrule_257825_subscription_manager_State: installed
+# R-257827 RHEL-09-215020
+rhel9STIG_stigrule_257827_Manage: True
+rhel9STIG_stigrule_257827_sendmail_State: removed
+# R-257828 RHEL-09-215025
+rhel9STIG_stigrule_257828_Manage: True
+rhel9STIG_stigrule_257828_nfs_utils_State: removed
+# R-257829 RHEL-09-215030
+rhel9STIG_stigrule_257829_Manage: True
+rhel9STIG_stigrule_257829_ypserv_State: removed
+# R-257830 RHEL-09-215035
+rhel9STIG_stigrule_257830_Manage: True
+rhel9STIG_stigrule_257830_rsh_server_State: removed
+# R-257831 RHEL-09-215040
+rhel9STIG_stigrule_257831_Manage: True
+rhel9STIG_stigrule_257831_telnet_server_State: removed
+# R-257832 RHEL-09-215045
+rhel9STIG_stigrule_257832_Manage: True
+rhel9STIG_stigrule_257832_gssproxy_State: removed
+# R-257833 RHEL-09-215050
+rhel9STIG_stigrule_257833_Manage: True
+rhel9STIG_stigrule_257833_iprutils_State: removed
+# R-257834 RHEL-09-215055
+rhel9STIG_stigrule_257834_Manage: True
+rhel9STIG_stigrule_257834_tuned_State: removed
+# R-257835 RHEL-09-215060
+rhel9STIG_stigrule_257835_Manage: True
+rhel9STIG_stigrule_257835_tftp_server_State: removed
+# R-257836 RHEL-09-215065
+rhel9STIG_stigrule_257836_Manage: True
+rhel9STIG_stigrule_257836_quagga_State: removed
+# R-257838 RHEL-09-215075
+rhel9STIG_stigrule_257838_Manage: True
+rhel9STIG_stigrule_257838_openssl_pkcs11_State: installed
+# R-257839 RHEL-09-215080
+rhel9STIG_stigrule_257839_Manage: True
+rhel9STIG_stigrule_257839_gnutls_utils_State: installed
+# R-257840 RHEL-09-215085
+rhel9STIG_stigrule_257840_Manage: True
+rhel9STIG_stigrule_257840_nss_tools_State: installed
+# R-257841 RHEL-09-215090
+rhel9STIG_stigrule_257841_Manage: True
+rhel9STIG_stigrule_257841_rng_tools_State: installed
+# R-257842 RHEL-09-215095
+rhel9STIG_stigrule_257842_Manage: True
+rhel9STIG_stigrule_257842_s_nail_State: installed
+# R-257849 RHEL-09-231040
+rhel9STIG_stigrule_257849_Manage: True
+rhel9STIG_stigrule_257849_autofs_service_disable_Enabled: false
+rhel9STIG_stigrule_257849_autofs_service_mask_Masked: true
+# R-257880 RHEL-09-231195
+rhel9STIG_stigrule_257880_Manage: True
+rhel9STIG_stigrule_257880__etc_modprobe_d_cramfs_conf_install_cramfs__bin_false_Line: 'install cramfs /bin/false'
+rhel9STIG_stigrule_257880__etc_modprobe_d_cramfs_conf_blacklist_cramfs_Line: 'blacklist cramfs'
+# R-257885 RHEL-09-232025
+rhel9STIG_stigrule_257885_Manage: True
+rhel9STIG_stigrule_257885__var_log_mode_Dest: /var/log
+rhel9STIG_stigrule_257885__var_log_mode_Mode: '0755'
+# R-257886 RHEL-09-232030
+rhel9STIG_stigrule_257886_Manage: True
+rhel9STIG_stigrule_257886__var_log_messages_mode_Dest: /var/log/messages
+rhel9STIG_stigrule_257886__var_log_messages_mode_Mode: '0640'
+# R-257891 RHEL-09-232055
+rhel9STIG_stigrule_257891_Manage: True
+rhel9STIG_stigrule_257891__etc_group_mode_Dest: /etc/group
+rhel9STIG_stigrule_257891__etc_group_mode_Mode: '0644'
+# R-257892 RHEL-09-232060
+rhel9STIG_stigrule_257892_Manage: True
+rhel9STIG_stigrule_257892__etc_group__mode_Dest: /etc/group-
+rhel9STIG_stigrule_257892__etc_group__mode_Mode: '0644'
+# R-257893 RHEL-09-232065
+rhel9STIG_stigrule_257893_Manage: True
+rhel9STIG_stigrule_257893__etc_gshadow_mode_Dest: /etc/gshadow
+rhel9STIG_stigrule_257893__etc_gshadow_mode_Mode: '0000'
+# R-257894 RHEL-09-232070
+rhel9STIG_stigrule_257894_Manage: True
+rhel9STIG_stigrule_257894__etc_gshadow__mode_Dest: /etc/gshadow-
+rhel9STIG_stigrule_257894__etc_gshadow__mode_Mode: '0000'
+# R-257895 RHEL-09-232075
+rhel9STIG_stigrule_257895_Manage: True
+rhel9STIG_stigrule_257895__etc_passwd_mode_Dest: /etc/passwd
+rhel9STIG_stigrule_257895__etc_passwd_mode_Mode: '0644'
+# R-257896 RHEL-09-232080
+rhel9STIG_stigrule_257896_Manage: True
+rhel9STIG_stigrule_257896__etc_passwd__mode_Dest: /etc/passwd-
+rhel9STIG_stigrule_257896__etc_passwd__mode_Mode: '0644'
+# R-257897 RHEL-09-232085
+rhel9STIG_stigrule_257897_Manage: True
+rhel9STIG_stigrule_257897__etc_shadow__mode_Dest: /etc/shadow-
+rhel9STIG_stigrule_257897__etc_shadow__mode_Mode: '0000'
+# R-257898 RHEL-09-232090
+rhel9STIG_stigrule_257898_Manage: True
+rhel9STIG_stigrule_257898__etc_group_owner_Dest: /etc/group
+rhel9STIG_stigrule_257898__etc_group_owner_Owner: root
+# R-257899 RHEL-09-232095
+rhel9STIG_stigrule_257899_Manage: True
+rhel9STIG_stigrule_257899__etc_group_group_owner_Dest: /etc/group
+rhel9STIG_stigrule_257899__etc_group_group_owner_Group: root
+# R-257900 RHEL-09-232100
+rhel9STIG_stigrule_257900_Manage: True
+rhel9STIG_stigrule_257900__etc_group__owner_Dest: /etc/group-
+rhel9STIG_stigrule_257900__etc_group__owner_Owner: root
+# R-257901 RHEL-09-232105
+rhel9STIG_stigrule_257901_Manage: True
+rhel9STIG_stigrule_257901__etc_group__group_owner_Dest: /etc/group-
+rhel9STIG_stigrule_257901__etc_group__group_owner_Group: root
+# R-257902 RHEL-09-232110
+rhel9STIG_stigrule_257902_Manage: True
+rhel9STIG_stigrule_257902__etc_gshadow_owner_Dest: /etc/gshadow
+rhel9STIG_stigrule_257902__etc_gshadow_owner_Owner: root
+# R-257903 RHEL-09-232115
+rhel9STIG_stigrule_257903_Manage: True
+rhel9STIG_stigrule_257903__etc_gshadow_group_owner_Dest: /etc/gshadow
+rhel9STIG_stigrule_257903__etc_gshadow_group_owner_Group: root
+# R-257904 RHEL-09-232120
+rhel9STIG_stigrule_257904_Manage: True
+rhel9STIG_stigrule_257904__etc_gshadow__owner_Dest: /etc/gshadow-
+rhel9STIG_stigrule_257904__etc_gshadow__owner_Owner: root
+# R-257905 RHEL-09-232125
+rhel9STIG_stigrule_257905_Manage: True
+rhel9STIG_stigrule_257905__etc_gshadow__group_owner_Dest: /etc/gshadow-
+rhel9STIG_stigrule_257905__etc_gshadow__group_owner_Group: root
+# R-257906 RHEL-09-232130
+rhel9STIG_stigrule_257906_Manage: True
+rhel9STIG_stigrule_257906__etc_passwd_owner_Dest: /etc/passwd
+rhel9STIG_stigrule_257906__etc_passwd_owner_Owner: root
+# R-257907 RHEL-09-232135
+rhel9STIG_stigrule_257907_Manage: True
+rhel9STIG_stigrule_257907__etc_passwd_group_owner_Dest: /etc/passwd
+rhel9STIG_stigrule_257907__etc_passwd_group_owner_Group: root
+# R-257908 RHEL-09-232140
+rhel9STIG_stigrule_257908_Manage: True
+rhel9STIG_stigrule_257908__etc_passwd__owner_Dest: /etc/passwd-
+rhel9STIG_stigrule_257908__etc_passwd__owner_Owner: root
+# R-257909 RHEL-09-232145
+rhel9STIG_stigrule_257909_Manage: True
+rhel9STIG_stigrule_257909__etc_passwd__group_owner_Dest: /etc/passwd-
+rhel9STIG_stigrule_257909__etc_passwd__group_owner_Group: root
+# R-257910 RHEL-09-232150
+rhel9STIG_stigrule_257910_Manage: True
+rhel9STIG_stigrule_257910__etc_shadow_owner_Dest: /etc/shadow
+rhel9STIG_stigrule_257910__etc_shadow_owner_Owner: root
+# R-257911 RHEL-09-232155
+rhel9STIG_stigrule_257911_Manage: True
+rhel9STIG_stigrule_257911__etc_shadow_group_owner_Dest: /etc/shadow
+rhel9STIG_stigrule_257911__etc_shadow_group_owner_Group: root
+# R-257912 RHEL-09-232160
+rhel9STIG_stigrule_257912_Manage: True
+rhel9STIG_stigrule_257912__etc_shadow__owner_Dest: /etc/shadow-
+rhel9STIG_stigrule_257912__etc_shadow__owner_Owner: root
+# R-257913 RHEL-09-232165
+rhel9STIG_stigrule_257913_Manage: True
+rhel9STIG_stigrule_257913__etc_shadow__group_owner_Dest: /etc/shadow-
+rhel9STIG_stigrule_257913__etc_shadow__group_owner_Group: root
+# R-257914 RHEL-09-232170
+rhel9STIG_stigrule_257914_Manage: True
+rhel9STIG_stigrule_257914__var_log_owner_Dest: /var/log
+rhel9STIG_stigrule_257914__var_log_owner_Owner: root
+# R-257915 RHEL-09-232175
+rhel9STIG_stigrule_257915_Manage: True
+rhel9STIG_stigrule_257915__var_log_group_owner_Dest: /var/log
+rhel9STIG_stigrule_257915__var_log_group_owner_Group: root
+# R-257916 RHEL-09-232180
+rhel9STIG_stigrule_257916_Manage: True
+rhel9STIG_stigrule_257916__var_log_messages_owner_Dest: /var/log/messages
+rhel9STIG_stigrule_257916__var_log_messages_owner_Owner: root
+# R-257917 RHEL-09-232185
+rhel9STIG_stigrule_257917_Manage: True
+rhel9STIG_stigrule_257917__var_log_messages_group_owner_Dest: /var/log/messages
+rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group: root
+# R-257934 RHEL-09-232270
+rhel9STIG_stigrule_257934_Manage: True
+rhel9STIG_stigrule_257934__etc_shadow_mode_Dest: /etc/shadow
+rhel9STIG_stigrule_257934__etc_shadow_mode_Mode: '0000'
+# R-257935 RHEL-09-251010
+rhel9STIG_stigrule_257935_Manage: True
+rhel9STIG_stigrule_257935_firewalld_State: installed
+# R-257936 RHEL-09-251015
+rhel9STIG_stigrule_257936_Manage: True
+rhel9STIG_stigrule_257936_firewalld_enable_Enabled: yes
+rhel9STIG_stigrule_257936_firewalld_start_State: started
+# R-257939 RHEL-09-251030
+rhel9STIG_stigrule_257939_Manage: True
+rhel9STIG_stigrule_257939__etc_firewalld_firewalld_conf_Line: 'FirewallBackend=nftables'
+# R-257942 RHEL-09-251045
+rhel9STIG_stigrule_257942_Manage: True
+rhel9STIG_stigrule_257942_net_core_bpf_jit_harden_Value: 2
+rhel9STIG_stigrule_257942_net_core_bpf_jit_harden_File: /etc/sysctl.d/99-sysctl.conf
+# R-257943 RHEL-09-252010
+rhel9STIG_stigrule_257943_Manage: True
+rhel9STIG_stigrule_257943_chrony_State: installed
+# R-257944 RHEL-09-252015
+rhel9STIG_stigrule_257944_Manage: True
+rhel9STIG_stigrule_257944_chronyd_enable_Enabled: yes
+rhel9STIG_stigrule_257944_chronyd_start_State: started
+# R-257946 RHEL-09-252025
+rhel9STIG_stigrule_257946_Manage: True
+rhel9STIG_stigrule_257946__etc_chrony_conf_Line: 'port 0'
+# R-257947 RHEL-09-252030
+rhel9STIG_stigrule_257947_Manage: True
+rhel9STIG_stigrule_257947__etc_chrony_conf_Line: 'cmdport 0'
+# R-257949 RHEL-09-252040
+rhel9STIG_stigrule_257949_Manage: True
+rhel9STIG_stigrule_257949__etc_NetworkManager_NetworkManager_conf_Value: 'none'
+# R-257954 RHEL-09-252065
+rhel9STIG_stigrule_257954_Manage: True
+rhel9STIG_stigrule_257954_libreswan_State: installed
+# R-257957 RHEL-09-253010
+rhel9STIG_stigrule_257957_Manage: True
+rhel9STIG_stigrule_257957_net_ipv4_tcp_syncookies_Value: 1
+rhel9STIG_stigrule_257957_net_ipv4_tcp_syncookies_File: /etc/sysctl.d/99-sysctl.conf
+# R-257958 RHEL-09-253015
+rhel9STIG_stigrule_257958_Manage: True
+rhel9STIG_stigrule_257958_net_ipv4_conf_all_accept_redirects_Value: 0
+rhel9STIG_stigrule_257958_net_ipv4_conf_all_accept_redirects_File: /etc/sysctl.d/99-sysctl.conf
+# R-257959 RHEL-09-253020
+rhel9STIG_stigrule_257959_Manage: True
+rhel9STIG_stigrule_257959_net_ipv4_conf_all_accept_source_route_Value: 0
+rhel9STIG_stigrule_257959_net_ipv4_conf_all_accept_source_route_File: /etc/sysctl.d/99-sysctl.conf
+# R-257960 RHEL-09-253025
+rhel9STIG_stigrule_257960_Manage: True
+rhel9STIG_stigrule_257960_net_ipv4_conf_all_log_martians_Value: 1
+rhel9STIG_stigrule_257960_net_ipv4_conf_all_log_martians_File: /etc/sysctl.d/99-sysctl.conf
+# R-257961 RHEL-09-253030
+rhel9STIG_stigrule_257961_Manage: True
+rhel9STIG_stigrule_257961_net_ipv4_conf_default_log_martians_Value: 1
+rhel9STIG_stigrule_257961_net_ipv4_conf_default_log_martians_File: /etc/sysctl.d/99-sysctl.conf
+# R-257962 RHEL-09-253035
+rhel9STIG_stigrule_257962_Manage: True
+rhel9STIG_stigrule_257962_net_ipv4_conf_all_rp_filter_Value: 1
+rhel9STIG_stigrule_257962_net_ipv4_conf_all_rp_filter_File: /etc/sysctl.d/99-sysctl.conf
+# R-257963 RHEL-09-253040
+rhel9STIG_stigrule_257963_Manage: True
+rhel9STIG_stigrule_257963_net_ipv4_conf_default_accept_redirects_Value: 0
+rhel9STIG_stigrule_257963_net_ipv4_conf_default_accept_redirects_File: /etc/sysctl.d/99-sysctl.conf
+# R-257964 RHEL-09-253045
+rhel9STIG_stigrule_257964_Manage: True
+rhel9STIG_stigrule_257964_net_ipv4_conf_default_accept_source_route_Value: 0
+rhel9STIG_stigrule_257964_net_ipv4_conf_default_accept_source_route_File: /etc/sysctl.d/99-sysctl.conf
+# R-257965 RHEL-09-253050
+rhel9STIG_stigrule_257965_Manage: True
+rhel9STIG_stigrule_257965_net_ipv4_conf_default_rp_filter_Value: 1
+rhel9STIG_stigrule_257965_net_ipv4_conf_default_rp_filter_File: /etc/sysctl.d/99-sysctl.conf
+# R-257966 RHEL-09-253055
+rhel9STIG_stigrule_257966_Manage: True
+rhel9STIG_stigrule_257966_net_ipv4_icmp_echo_ignore_broadcasts_Value: 1
+rhel9STIG_stigrule_257966_net_ipv4_icmp_echo_ignore_broadcasts_File: /etc/sysctl.d/99-sysctl.conf
+# R-257967 RHEL-09-253060
+rhel9STIG_stigrule_257967_Manage: True
+rhel9STIG_stigrule_257967_net_ipv4_icmp_ignore_bogus_error_responses_Value: 1
+rhel9STIG_stigrule_257967_net_ipv4_icmp_ignore_bogus_error_responses_File: /etc/sysctl.d/99-sysctl.conf
+# R-257968 RHEL-09-253065
+rhel9STIG_stigrule_257968_Manage: True
+rhel9STIG_stigrule_257968_net_ipv4_conf_all_send_redirects_Value: 0
+rhel9STIG_stigrule_257968_net_ipv4_conf_all_send_redirects_File: /etc/sysctl.d/99-sysctl.conf
+# R-257969 RHEL-09-253070
+rhel9STIG_stigrule_257969_Manage: True
+rhel9STIG_stigrule_257969_net_ipv4_conf_default_send_redirects_Value: 0
+rhel9STIG_stigrule_257969_net_ipv4_conf_default_send_redirects_File: /etc/sysctl.d/99-sysctl.conf
+# R-257970 RHEL-09-253075
+rhel9STIG_stigrule_257970_Manage: True
+rhel9STIG_stigrule_257970_net_ipv4_conf_all_forwarding_Value: 0
+rhel9STIG_stigrule_257970_net_ipv4_conf_all_forwarding_File: /etc/sysctl.d/99-sysctl.conf
+# R-257971 RHEL-09-254010
+rhel9STIG_stigrule_257971_Manage: True
+rhel9STIG_stigrule_257971_net_ipv6_conf_all_accept_ra_Value: 0
+rhel9STIG_stigrule_257971_net_ipv6_conf_all_accept_ra_File: /etc/sysctl.d/99-sysctl.conf
+# R-257972 RHEL-09-254015
+rhel9STIG_stigrule_257972_Manage: True
+rhel9STIG_stigrule_257972_net_ipv6_conf_all_accept_redirects_Value: 0
+rhel9STIG_stigrule_257972_net_ipv6_conf_all_accept_redirects_File: /etc/sysctl.d/99-sysctl.conf
+# R-257973 RHEL-09-254020
+rhel9STIG_stigrule_257973_Manage: True
+rhel9STIG_stigrule_257973_net_ipv6_conf_all_accept_source_route_Value: 0
+rhel9STIG_stigrule_257973_net_ipv6_conf_all_accept_source_route_File: /etc/sysctl.d/99-sysctl.conf
+# R-257974 RHEL-09-254025
+rhel9STIG_stigrule_257974_Manage: True
+rhel9STIG_stigrule_257974_net_ipv6_conf_all_forwarding_Value: 0
+rhel9STIG_stigrule_257974_net_ipv6_conf_all_forwarding_File: /etc/sysctl.d/99-sysctl.conf
+# R-257975 RHEL-09-254030
+rhel9STIG_stigrule_257975_Manage: True
+rhel9STIG_stigrule_257975_net_ipv6_conf_default_accept_ra_Value: 0
+rhel9STIG_stigrule_257975_net_ipv6_conf_default_accept_ra_File: /etc/sysctl.d/99-sysctl.conf
+# R-257976 RHEL-09-254035
+rhel9STIG_stigrule_257976_Manage: True
+rhel9STIG_stigrule_257976_net_ipv6_conf_default_accept_redirects_Value: 0
+rhel9STIG_stigrule_257976_net_ipv6_conf_default_accept_redirects_File: /etc/sysctl.d/99-sysctl.conf
+# R-257977 RHEL-09-254040
+rhel9STIG_stigrule_257977_Manage: True
+rhel9STIG_stigrule_257977_net_ipv6_conf_default_accept_source_route_Value: 0
+rhel9STIG_stigrule_257977_net_ipv6_conf_default_accept_source_route_File: /etc/sysctl.d/99-sysctl.conf
+# R-257978 RHEL-09-255010
+rhel9STIG_stigrule_257978_Manage: True
+rhel9STIG_stigrule_257978_openssh_server_State: installed
+# R-257979 RHEL-09-255015
+rhel9STIG_stigrule_257979_Manage: True
+rhel9STIG_stigrule_257979_sshd_enable_Enabled: yes
+rhel9STIG_stigrule_257979_sshd_start_State: started
+# R-257980 RHEL-09-255020
+rhel9STIG_stigrule_257980_Manage: True
+rhel9STIG_stigrule_257980_openssh_clients_State: installed
+# R-257981 RHEL-09-255025
+rhel9STIG_stigrule_257981_Manage: True
+rhel9STIG_stigrule_257981_Banner_Line: Banner /etc/issue
+# R-257982 RHEL-09-255030
+rhel9STIG_stigrule_257982_Manage: True
+rhel9STIG_stigrule_257982_LogLevel_Line: LogLevel VERBOSE
+# R-257983 RHEL-09-255035
+rhel9STIG_stigrule_257983_Manage: True
+rhel9STIG_stigrule_257983_PubkeyAuthentication_Line: PubkeyAuthentication yes
+# R-257984 RHEL-09-255040
+rhel9STIG_stigrule_257984_Manage: True
+rhel9STIG_stigrule_257984_PermitEmptyPasswords_Line: PermitEmptyPasswords no
+# R-257985 RHEL-09-255045
+rhel9STIG_stigrule_257985_Manage: True
+rhel9STIG_stigrule_257985_PermitRootLogin_Line: PermitRootLogin no
+# R-257986 RHEL-09-255050
+rhel9STIG_stigrule_257986_Manage: True
+rhel9STIG_stigrule_257986_UsePAM_Line: UsePAM yes
+# R-257992 RHEL-09-255080
+rhel9STIG_stigrule_257992_Manage: True
+rhel9STIG_stigrule_257992_HostbasedAuthentication_Line: HostbasedAuthentication no
+# R-257993 RHEL-09-255085
+rhel9STIG_stigrule_257993_Manage: True
+rhel9STIG_stigrule_257993_PermitUserEnvironment_Line: PermitUserEnvironment no
+# R-257994 RHEL-09-255090
+rhel9STIG_stigrule_257994_Manage: True
+rhel9STIG_stigrule_257994_RekeyLimit_Line: RekeyLimit 1G 1h
+# R-257995 RHEL-09-255095
+rhel9STIG_stigrule_257995_Manage: True
+rhel9STIG_stigrule_257995_ClientAliveCountMax_Line: ClientAliveCountMax 1
+# R-257996 RHEL-09-255100
+rhel9STIG_stigrule_257996_Manage: True
+rhel9STIG_stigrule_257996_ClientAliveInterval_Line: ClientAliveInterval 600
+# R-257997 RHEL-09-255105
+rhel9STIG_stigrule_257997_Manage: True
+rhel9STIG_stigrule_257997__etc_ssh_sshd_config_group_owner_Dest: /etc/ssh/sshd_config
+rhel9STIG_stigrule_257997__etc_ssh_sshd_config_group_owner_Group: root
+# R-257998 RHEL-09-255110
+rhel9STIG_stigrule_257998_Manage: True
+rhel9STIG_stigrule_257998__etc_ssh_sshd_config_owner_Dest: /etc/ssh/sshd_config
+rhel9STIG_stigrule_257998__etc_ssh_sshd_config_owner_Owner: root
+# R-257999 RHEL-09-255115
+rhel9STIG_stigrule_257999_Manage: True
+rhel9STIG_stigrule_257999__etc_ssh_sshd_config_mode_Dest: /etc/ssh/sshd_config
+rhel9STIG_stigrule_257999__etc_ssh_sshd_config_mode_Mode: '0600'
+# R-258002 RHEL-09-255130
+rhel9STIG_stigrule_258002_Manage: True
+rhel9STIG_stigrule_258002_Compression_Line: Compression no
+# R-258003 RHEL-09-255135
+rhel9STIG_stigrule_258003_Manage: True
+rhel9STIG_stigrule_258003_GSSAPIAuthentication_Line: GSSAPIAuthentication no
+# R-258004 RHEL-09-255140
+rhel9STIG_stigrule_258004_Manage: True
+rhel9STIG_stigrule_258004_KerberosAuthentication_Line: KerberosAuthentication no
+# R-258005 RHEL-09-255145
+rhel9STIG_stigrule_258005_Manage: True
+rhel9STIG_stigrule_258005_IgnoreRhosts_Line: IgnoreRhosts yes
+# R-258006 RHEL-09-255150
+rhel9STIG_stigrule_258006_Manage: True
+rhel9STIG_stigrule_258006_IgnoreUserKnownHosts_Line: IgnoreUserKnownHosts yes
+# R-258007 RHEL-09-255155
+rhel9STIG_stigrule_258007_Manage: True
+rhel9STIG_stigrule_258007_X11Forwarding_Line: X11Forwarding no
+# R-258008 RHEL-09-255160
+rhel9STIG_stigrule_258008_Manage: True
+rhel9STIG_stigrule_258008_StrictModes_Line: StrictModes yes
+# R-258009 RHEL-09-255165
+rhel9STIG_stigrule_258009_Manage: True
+rhel9STIG_stigrule_258009_PrintLastLog_Line: PrintLastLog yes
+# R-258011 RHEL-09-255175
+rhel9STIG_stigrule_258011_Manage: True
+rhel9STIG_stigrule_258011_X11UseLocalhost_Line: X11UseLocalhost yes
+# R-258012 RHEL-09-271010
+rhel9STIG_stigrule_258012_Manage: True
+rhel9STIG_stigrule_258012__etc_dconf_db_local_d_01_banner_message_Value: 'true'
+# R-258013 RHEL-09-271015
+rhel9STIG_stigrule_258013_Manage: True
+rhel9STIG_stigrule_258013__etc_dconf_db_local_d_locks_session_banner_message_enable_Line: '/org/gnome/login-screen/banner-message-enable'
+# R-258014 RHEL-09-271020
+rhel9STIG_stigrule_258014_Manage: True
+rhel9STIG_stigrule_258014__etc_dconf_db_local_d_00_security_settings_Value: 'false'
+# R-258015 RHEL-09-271025
+rhel9STIG_stigrule_258015_Manage: True
+rhel9STIG_stigrule_258015__etc_dconf_db_local_d_locks_00_security_settings_lock_automount_open_Line: '/org/gnome/desktop/media-handling/automount-open'
+# R-258016 RHEL-09-271030
+rhel9STIG_stigrule_258016_Manage: True
+rhel9STIG_stigrule_258016__etc_dconf_db_local_d_00_security_settings_Value: 'true'
+# R-258017 RHEL-09-271035
+rhel9STIG_stigrule_258017_Manage: True
+rhel9STIG_stigrule_258017__etc_dconf_db_local_d_locks_00_security_settings_lock_autorun_never_Line: '/org/gnome/desktop/media-handling/autorun-never'
+# R-258019 RHEL-09-271045
+rhel9STIG_stigrule_258019_Manage: True
+rhel9STIG_stigrule_258019__etc_dconf_db_local_d_00_security_settings_Value: "'lock-screen'"
+# R-258020 RHEL-09-271050
+rhel9STIG_stigrule_258020_Manage: True
+rhel9STIG_stigrule_258020__etc_dconf_db_local_d_locks_00_security_settings_lock_removal_action_Line: '/org/gnome/settings-daemon/peripherals/smartcard/removal-action'
+# R-258021 RHEL-09-271055
+rhel9STIG_stigrule_258021_Manage: True
+rhel9STIG_stigrule_258021__etc_dconf_db_local_d_00_screensaver_Value: 'true'
+# R-258022 RHEL-09-271060
+rhel9STIG_stigrule_258022_Manage: True
+rhel9STIG_stigrule_258022__etc_dconf_db_local_d_locks_session_lock_enabled_Line: '/org/gnome/desktop/screensaver/lock-enabled'
+# R-258023 RHEL-09-271065
+rhel9STIG_stigrule_258023_Manage: True
+rhel9STIG_stigrule_258023__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 900'
+# R-258024 RHEL-09-271070
+rhel9STIG_stigrule_258024_Manage: True
+rhel9STIG_stigrule_258024__etc_dconf_db_local_d_locks_session_idle_delay_Line: '/org/gnome/desktop/session/idle-delay'
+# R-258025 RHEL-09-271075
+rhel9STIG_stigrule_258025_Manage: True
+rhel9STIG_stigrule_258025__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 5'
+# R-258026 RHEL-09-271080
+rhel9STIG_stigrule_258026_Manage: True
+rhel9STIG_stigrule_258026__etc_dconf_db_local_d_locks_session_lock_delay_Line: '/org/gnome/desktop/screensaver/lock-delay'
+# R-258027 RHEL-09-271085
+rhel9STIG_stigrule_258027_Manage: True
+rhel9STIG_stigrule_258027__etc_dconf_db_local_d_00_security_settings_Value: "''"
+# R-258027 RHEL-09-271085
+rhel9STIG_stigrule_258027_Manage: True
+rhel9STIG_stigrule_258027__etc_dconf_db_local_d_locks_00_security_settings_lock_picture_uri_Line: '/org/gnome/desktop/screensaver/picture-uri'
+# R-258030 RHEL-09-271100
+rhel9STIG_stigrule_258030_Manage: True
+rhel9STIG_stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons_Line: '/org/gnome/login-screen/disable-restart-buttons'
+# R-258031 RHEL-09-271105
+rhel9STIG_stigrule_258031_Manage: True
+rhel9STIG_stigrule_258031__etc_dconf_db_local_d_00_security_settings_Value: "['']"
+# R-258032 RHEL-09-271110
+rhel9STIG_stigrule_258032_Manage: True
+rhel9STIG_stigrule_258032__etc_dconf_db_local_d_locks_session_logout_Line: '/org/gnome/settings-daemon/plugins/media-keys/logout'
+# R-258033 RHEL-09-271115
+rhel9STIG_stigrule_258033_Manage: True
+rhel9STIG_stigrule_258033__etc_dconf_db_local_d_02_login_screen_Value: 'true'
+# R-258034 RHEL-09-291010
+rhel9STIG_stigrule_258034_Manage: True
+rhel9STIG_stigrule_258034__etc_modprobe_d_usb_storage_conf_install_usb_storage__bin_false_Line: 'install usb-storage /bin/false'
+rhel9STIG_stigrule_258034__etc_modprobe_d_usb_storage_conf_blacklist_usb_storage_Line: 'blacklist usb-storage'
+# R-258035 RHEL-09-291015
+rhel9STIG_stigrule_258035_Manage: True
+rhel9STIG_stigrule_258035_usbguard_State: installed
+rhel9STIG_stigrule_258035_usbguard_enable_Enabled: yes
+rhel9STIG_stigrule_258035_usbguard_start_State: started
+# R-258036 RHEL-09-291020
+rhel9STIG_stigrule_258036_Manage: True
+rhel9STIG_stigrule_258036_usbguard_enable_Enabled: yes
+rhel9STIG_stigrule_258036_usbguard_start_State: started
+# R-258037 RHEL-09-291025
+rhel9STIG_stigrule_258037_Manage: True
+rhel9STIG_stigrule_258037__etc_usbguard_usbguard_daemon_conf_Line: 'AuditBackend=LinuxAudit'
+# R-258039 RHEL-09-291035
+rhel9STIG_stigrule_258039_Manage: True
+rhel9STIG_stigrule_258039__etc_modprobe_d_bluetooth_conf_install_bluetooth__bin_false_Line: 'install bluetooth /bin/false'
+rhel9STIG_stigrule_258039__etc_modprobe_d_bluetooth_conf_blacklist_bluetooth_Line: 'blacklist bluetooth'
+# R-258040 RHEL-09-291040
+rhel9STIG_stigrule_258040_Manage: True
+rhel9STIG_stigrule_258040_nmcli_radio_wifi_off_Command: nmcli radio wifi off
+# R-258041 RHEL-09-411010
+rhel9STIG_stigrule_258041_Manage: True
+rhel9STIG_stigrule_258041__etc_login_defs_Line: 'PASS_MAX_DAYS 60'
+# R-258043 RHEL-09-411020
+rhel9STIG_stigrule_258043_Manage: True
+rhel9STIG_stigrule_258043__etc_login_defs_Line: 'CREATE_HOME yes'
+# R-258049 RHEL-09-411050
+rhel9STIG_stigrule_258049_Manage: True
+rhel9STIG_stigrule_258049_sudo_useradd__D__f_35_Command: sudo useradd -D -f 35
+# R-258054 RHEL-09-411075
+rhel9STIG_stigrule_258054_Manage: True
+rhel9STIG_stigrule_258054__etc_security_faillock_conf_Line: 'deny = 3'
+# R-258055 RHEL-09-411080
+rhel9STIG_stigrule_258055_Manage: True
+rhel9STIG_stigrule_258055__etc_security_faillock_conf_Line: 'even_deny_root'
+# R-258056 RHEL-09-411085
+rhel9STIG_stigrule_258056_Manage: True
+rhel9STIG_stigrule_258056__etc_security_faillock_conf_Line: 'fail_interval = 900'
+# R-258057 RHEL-09-411090
+rhel9STIG_stigrule_258057_Manage: True
+rhel9STIG_stigrule_258057__etc_security_faillock_conf_Line: 'unlock_time = 0'
+# R-258060 RHEL-09-411105
+rhel9STIG_stigrule_258060_Manage: True
+rhel9STIG_stigrule_258060__etc_security_faillock_conf_Line: 'dir = /var/log/faillock'
+# R-258069 RHEL-09-412040
+rhel9STIG_stigrule_258069_Manage: True
+rhel9STIG_stigrule_258069__etc_security_limits_conf_Line: '* hard maxlogins 10'
+# R-258070 RHEL-09-412045
+rhel9STIG_stigrule_258070_Manage: True
+rhel9STIG_stigrule_258070__etc_security_faillock_conf_Line: 'audit'
+# R-258071 RHEL-09-412050
+rhel9STIG_stigrule_258071_Manage: True
+rhel9STIG_stigrule_258071__etc_login_defs_Line: 'FAIL_DELAY 4'
+# R-258072 RHEL-09-412055
+rhel9STIG_stigrule_258072_Manage: True
+rhel9STIG_stigrule_258072__etc_bashrc_Line: 'umask 077'
+# R-258073 RHEL-09-412060
+rhel9STIG_stigrule_258073_Manage: True
+rhel9STIG_stigrule_258073__etc_csh_cshrc_Line: 'umask 077'
+# R-258074 RHEL-09-412065
+rhel9STIG_stigrule_258074_Manage: True
+rhel9STIG_stigrule_258074__etc_login_defs_Line: 'UMASK 077'
+# R-258075 RHEL-09-412070
+rhel9STIG_stigrule_258075_Manage: True
+rhel9STIG_stigrule_258075__etc_profile_Line: 'umask 077'
+# R-258078 RHEL-09-431010
+rhel9STIG_stigrule_258078_Manage: True
+rhel9STIG_stigrule_258078__etc_selinux_config_Line: 'SELINUX=enforcing'
+# R-258079 RHEL-09-431015
+rhel9STIG_stigrule_258079_Manage: True
+rhel9STIG_stigrule_258079__etc_selinux_config_Line: 'SELINUXTYPE=targeted'
+# R-258081 RHEL-09-431025
+rhel9STIG_stigrule_258081_Manage: True
+rhel9STIG_stigrule_258081_policycoreutils_State: installed
+# R-258082 RHEL-09-431030
+rhel9STIG_stigrule_258082_Manage: True
+rhel9STIG_stigrule_258082_policycoreutils_python_utils_State: installed
+# R-258083 RHEL-09-432010
+rhel9STIG_stigrule_258083_Manage: True
+rhel9STIG_stigrule_258083_sudo_State: installed
+# R-258084 RHEL-09-432015
+rhel9STIG_stigrule_258084_Manage: True
+rhel9STIG_stigrule_258084__etc_sudoers_Line: 'Defaults timestamp_timeout=0'
+# R-258089 RHEL-09-433010
+rhel9STIG_stigrule_258089_Manage: True
+rhel9STIG_stigrule_258089_fapolicyd_State: installed
+# R-258090 RHEL-09-433015
+rhel9STIG_stigrule_258090_Manage: True
+rhel9STIG_stigrule_258090_fapolicyd_enable_Enabled: yes
+rhel9STIG_stigrule_258090_fapolicyd_start_State: started
+# R-258101 RHEL-09-611060
+rhel9STIG_stigrule_258101_Manage: True
+rhel9STIG_stigrule_258101__etc_security_pwquality_conf_Line: 'enforce_for_root'
+# R-258102 RHEL-09-611065
+rhel9STIG_stigrule_258102_Manage: True
+rhel9STIG_stigrule_258102__etc_security_pwquality_conf_Line: 'lcredit = -1'
+# R-258103 RHEL-09-611070
+rhel9STIG_stigrule_258103_Manage: True
+rhel9STIG_stigrule_258103__etc_security_pwquality_conf_Line: 'dcredit = -1'
+# R-258104 RHEL-09-611075
+rhel9STIG_stigrule_258104_Manage: True
+rhel9STIG_stigrule_258104__etc_login_defs_Line: 'PASS_MIN_DAYS 1'
+# R-258107 RHEL-09-611090
+rhel9STIG_stigrule_258107_Manage: True
+rhel9STIG_stigrule_258107__etc_security_pwquality_conf_Line: 'minlen = 15'
+# R-258109 RHEL-09-611100
+rhel9STIG_stigrule_258109_Manage: True
+rhel9STIG_stigrule_258109__etc_security_pwquality_conf_Line: 'ocredit = -1'
+# R-258110 RHEL-09-611105
+rhel9STIG_stigrule_258110_Manage: True
+rhel9STIG_stigrule_258110__etc_security_pwquality_conf_Line: 'dictcheck = 1'
+# R-258111 RHEL-09-611110
+rhel9STIG_stigrule_258111_Manage: True
+rhel9STIG_stigrule_258111__etc_security_pwquality_conf_Line: 'ucredit = -1'
+# R-258112 RHEL-09-611115
+rhel9STIG_stigrule_258112_Manage: True
+rhel9STIG_stigrule_258112__etc_security_pwquality_conf_Line: 'difok = 8'
+# R-258113 RHEL-09-611120
+rhel9STIG_stigrule_258113_Manage: True
+rhel9STIG_stigrule_258113__etc_security_pwquality_conf_Line: 'maxclassrepeat = 4'
+# R-258114 RHEL-09-611125
+rhel9STIG_stigrule_258114_Manage: True
+rhel9STIG_stigrule_258114__etc_security_pwquality_conf_Line: 'maxrepeat = 3'
+# R-258115 RHEL-09-611130
+rhel9STIG_stigrule_258115_Manage: True
+rhel9STIG_stigrule_258115__etc_security_pwquality_conf_Line: 'minclass = 4'
+# R-258116 RHEL-09-611135
+rhel9STIG_stigrule_258116_Manage: True
+rhel9STIG_stigrule_258116__etc_libuser_conf_Value: 'sha512'
+# R-258117 RHEL-09-611140
+rhel9STIG_stigrule_258117_Manage: True
+rhel9STIG_stigrule_258117__etc_login_defs_Line: 'ENCRYPT_METHOD SHA512'
+# R-258121 RHEL-09-611160
+rhel9STIG_stigrule_258121_Manage: True
+rhel9STIG_stigrule_258121__etc_opensc_conf_Line: 'card_drivers = cac;'
+# R-258122 RHEL-09-611165
+rhel9STIG_stigrule_258122_Manage: True
+rhel9STIG_stigrule_258122__etc_sssd_sssd_conf_Value: 'True'
+# R-258124 RHEL-09-611175
+rhel9STIG_stigrule_258124_Manage: True
+rhel9STIG_stigrule_258124_pcsc_lite_State: installed
+# R-258125 RHEL-09-611180
+rhel9STIG_stigrule_258125_Manage: True
+rhel9STIG_stigrule_258125_pcscd_enable_Enabled: yes
+rhel9STIG_stigrule_258125_pcscd_start_State: started
+# R-258126 RHEL-09-611185
+rhel9STIG_stigrule_258126_Manage: True
+rhel9STIG_stigrule_258126_opensc_State: installed
+# R-258128 RHEL-09-611195
+rhel9STIG_stigrule_258128_Manage: True
+rhel9STIG_stigrule_258128__usr_lib_systemd_system_emergency_service_Value: '-/usr/lib/systemd/systemd-sulogin-shell emergency'
+# R-258129 RHEL-09-611200
+rhel9STIG_stigrule_258129_Manage: True
+rhel9STIG_stigrule_258129__usr_lib_systemd_system_rescue_service_Value: '-/usr/lib/systemd/systemd-sulogin-shell rescue'
+# R-258133 RHEL-09-631020
+rhel9STIG_stigrule_258133_Manage: True
+rhel9STIG_stigrule_258133__etc_sssd_sssd_conf_Value: '1'
+# R-258140 RHEL-09-652010
+rhel9STIG_stigrule_258140_Manage: True
+rhel9STIG_stigrule_258140_rsyslog_State: installed
+# R-258141 RHEL-09-652015
+rhel9STIG_stigrule_258141_Manage: True
+rhel9STIG_stigrule_258141_rsyslog_gnutls_State: installed
+# R-258142 RHEL-09-652020
+rhel9STIG_stigrule_258142_Manage: True
+rhel9STIG_stigrule_258142_rsyslog_enable_Enabled: yes
+rhel9STIG_stigrule_258142_rsyslog_start_State: started
+# R-258144 RHEL-09-652030
+rhel9STIG_stigrule_258144_Manage: True
+rhel9STIG_stigrule_258144__etc_rsyslog_conf_Line: 'auth.*;authpriv.*;daemon.*                              /var/log/secure'
+# R-258146 RHEL-09-652040
+rhel9STIG_stigrule_258146_Manage: True
+rhel9STIG_stigrule_258146__etc_rsyslog_conf_Line: '$ActionSendStreamDriverAuthMode x509/name'
+# R-258147 RHEL-09-652045
+rhel9STIG_stigrule_258147_Manage: True
+rhel9STIG_stigrule_258147__etc_rsyslog_conf_Line: '$ActionSendStreamDriverMode 1'
+# R-258148 RHEL-09-652050
+rhel9STIG_stigrule_258148_Manage: True
+rhel9STIG_stigrule_258148__etc_rsyslog_conf_Line: '$DefaultNetstreamDriver gtls'
+# R-258150 RHEL-09-652060
+rhel9STIG_stigrule_258150_Manage: True
+rhel9STIG_stigrule_258150__etc_rsyslog_conf_Line: 'cron.*                                                  /var/log/cron'
+# R-258151 RHEL-09-653010
+rhel9STIG_stigrule_258151_Manage: True
+rhel9STIG_stigrule_258151_audit_State: installed
+# R-258152 RHEL-09-653015
+rhel9STIG_stigrule_258152_Manage: True
+rhel9STIG_stigrule_258152_auditd_enable_Enabled: yes
+rhel9STIG_stigrule_258152_auditd_start_State: started
+# R-258153 RHEL-09-653020
+rhel9STIG_stigrule_258153_Manage: True
+rhel9STIG_stigrule_258153__etc_audit_auditd_conf_Line: 'disk_error_action = HALT'
+# R-258154 RHEL-09-653025
+rhel9STIG_stigrule_258154_Manage: True
+rhel9STIG_stigrule_258154__etc_audit_auditd_conf_Line: 'disk_full_action = HALT'
+# R-258156 RHEL-09-653035
+rhel9STIG_stigrule_258156_Manage: True
+rhel9STIG_stigrule_258156__etc_audit_auditd_conf_Line: 'space_left = 25%'
+# R-258157 RHEL-09-653040
+rhel9STIG_stigrule_258157_Manage: True
+rhel9STIG_stigrule_258157__etc_audit_auditd_conf_Line: 'space_left_action = email'
+# R-258158 RHEL-09-653045
+rhel9STIG_stigrule_258158_Manage: True
+rhel9STIG_stigrule_258158__etc_audit_auditd_conf_Line: 'admin_space_left = 5%'
+# R-258159 RHEL-09-653050
+rhel9STIG_stigrule_258159_Manage: True
+rhel9STIG_stigrule_258159__etc_audit_auditd_conf_Line: 'admin_space_left_action = single'
+# R-258160 RHEL-09-653055
+rhel9STIG_stigrule_258160_Manage: True
+rhel9STIG_stigrule_258160__etc_audit_auditd_conf_Line: 'max_log_file_action = ROTATE'
+# R-258161 RHEL-09-653060
+rhel9STIG_stigrule_258161_Manage: True
+rhel9STIG_stigrule_258161__etc_audit_auditd_conf_Line: 'name_format = hostname'
+# R-258162 RHEL-09-653065
+rhel9STIG_stigrule_258162_Manage: True
+rhel9STIG_stigrule_258162__etc_audit_auditd_conf_Line: 'overflow_action = syslog'
+# R-258163 RHEL-09-653070
+rhel9STIG_stigrule_258163_Manage: True
+rhel9STIG_stigrule_258163__etc_audit_auditd_conf_Line: 'action_mail_acct = root'
+# R-258164 RHEL-09-653075
+rhel9STIG_stigrule_258164_Manage: True
+rhel9STIG_stigrule_258164__etc_audit_auditd_conf_Line: 'local_events = yes'
+# R-258168 RHEL-09-653095
+rhel9STIG_stigrule_258168_Manage: True
+rhel9STIG_stigrule_258168__etc_audit_auditd_conf_Line: 'freq = 100'
+# R-258169 RHEL-09-653100
+rhel9STIG_stigrule_258169_Manage: True
+rhel9STIG_stigrule_258169__etc_audit_auditd_conf_Line: 'log_format = ENRICHED'
+# R-258170 RHEL-09-653105
+rhel9STIG_stigrule_258170_Manage: True
+rhel9STIG_stigrule_258170__etc_audit_auditd_conf_Line: 'write_logs = yes'
+# R-258172 RHEL-09-653115
+rhel9STIG_stigrule_258172_Manage: True
+rhel9STIG_stigrule_258172__etc_audit_auditd_conf_mode_Dest: /etc/audit/auditd.conf
+rhel9STIG_stigrule_258172__etc_audit_auditd_conf_mode_Mode: '0640'
+# R-258175 RHEL-09-653130
+rhel9STIG_stigrule_258175_Manage: True
+rhel9STIG_stigrule_258175_audispd_plugins_State: installed
+# R-258176 RHEL-09-654010
+rhel9STIG_stigrule_258176_Manage: True
+rhel9STIG_stigrule_258176__etc_audit_rules_d_audit_rules_execve_euid_b32_Line: '-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv'
+rhel9STIG_stigrule_258176__etc_audit_rules_d_audit_rules_execve_euid_b64_Line: '-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv'
+rhel9STIG_stigrule_258176__etc_audit_rules_d_audit_rules_execve_egid_b32_Line: '-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv'
+rhel9STIG_stigrule_258176__etc_audit_rules_d_audit_rules_execve_egid_b64_Line: '-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv'
+# R-258177 RHEL-09-654015
+rhel9STIG_stigrule_258177_Manage: True
+rhel9STIG_stigrule_258177__etc_audit_rules_d_audit_rules_chmod_b32_Line: '-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
+rhel9STIG_stigrule_258177__etc_audit_rules_d_audit_rules_chmod_b64_Line: '-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod'
+# R-258178 RHEL-09-654020
+rhel9STIG_stigrule_258178_Manage: True
+rhel9STIG_stigrule_258178__etc_audit_rules_d_audit_rules_chown_b32_Line: '-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
+rhel9STIG_stigrule_258178__etc_audit_rules_d_audit_rules_chown_b64_Line: '-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod'
+# R-258179 RHEL-09-654025
+rhel9STIG_stigrule_258179_Manage: True
+rhel9STIG_stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset_Line: '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
+rhel9STIG_stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset_Line: '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod'
+rhel9STIG_stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b32_Line: '-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
+rhel9STIG_stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b64_Line: '-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod'
+# R-258180 RHEL-09-654030
+rhel9STIG_stigrule_258180_Manage: True
+rhel9STIG_stigrule_258180__etc_audit_rules_d_audit_rules__usr_bin_umount_Line: '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'
+# R-258181 RHEL-09-654035
+rhel9STIG_stigrule_258181_Manage: True
+rhel9STIG_stigrule_258181__etc_audit_rules_d_audit_rules__usr_bin_chacl_Line: '-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'
+# R-258182 RHEL-09-654040
+rhel9STIG_stigrule_258182_Manage: True
+rhel9STIG_stigrule_258182__etc_audit_rules_d_audit_rules__usr_bin_setfacl_Line: '-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'
+# R-258183 RHEL-09-654045
+rhel9STIG_stigrule_258183_Manage: True
+rhel9STIG_stigrule_258183__etc_audit_rules_d_audit_rules__usr_bin_chcon_Line: '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod'
+# R-258184 RHEL-09-654050
+rhel9STIG_stigrule_258184_Manage: True
+rhel9STIG_stigrule_258184__etc_audit_rules_d_audit_rules__usr_sbin_semanage_Line: '-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258185 RHEL-09-654055
+rhel9STIG_stigrule_258185_Manage: True
+rhel9STIG_stigrule_258185__etc_audit_rules_d_audit_rules__usr_sbin_setfiles_Line: '-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258186 RHEL-09-654060
+rhel9STIG_stigrule_258186_Manage: True
+rhel9STIG_stigrule_258186__etc_audit_rules_d_audit_rules__usr_sbin_setsebool_Line: '-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'
+# R-258187 RHEL-09-654065
+rhel9STIG_stigrule_258187_Manage: True
+rhel9STIG_stigrule_258187__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
+rhel9STIG_stigrule_258187__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
+# R-258188 RHEL-09-654070
+rhel9STIG_stigrule_258188_Manage: True
+rhel9STIG_stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EPERM_b32_Line: '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
+rhel9STIG_stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EPERM_b64_Line: '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access'
+rhel9STIG_stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EACCES_b32_Line: '-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
+rhel9STIG_stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EACCES_b64_Line: '-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access'
+# R-258189 RHEL-09-654075
+rhel9STIG_stigrule_258189_Manage: True
+rhel9STIG_stigrule_258189__etc_audit_rules_d_audit_rules_delete_module_b32_Line: '-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
+rhel9STIG_stigrule_258189__etc_audit_rules_d_audit_rules_delete_module_b64_Line: '-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng'
+# R-258190 RHEL-09-654080
+rhel9STIG_stigrule_258190_Manage: True
+rhel9STIG_stigrule_258190__etc_audit_rules_d_audit_rules_init_module_b32_Line: '-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
+rhel9STIG_stigrule_258190__etc_audit_rules_d_audit_rules_init_module_b64_Line: '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
+# R-258191 RHEL-09-654085
+rhel9STIG_stigrule_258191_Manage: True
+rhel9STIG_stigrule_258191__etc_audit_rules_d_audit_rules__usr_bin_chage_Line: '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage'
+# R-258192 RHEL-09-654090
+rhel9STIG_stigrule_258192_Manage: True
+rhel9STIG_stigrule_258192__etc_audit_rules_d_audit_rules__usr_bin_chsh_Line: '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
+# R-258193 RHEL-09-654095
+rhel9STIG_stigrule_258193_Manage: True
+rhel9STIG_stigrule_258193__etc_audit_rules_d_audit_rules__usr_bin_crontab_Line: '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab'
+# R-258194 RHEL-09-654100
+rhel9STIG_stigrule_258194_Manage: True
+rhel9STIG_stigrule_258194__etc_audit_rules_d_audit_rules__usr_bin_gpasswd_Line: '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'
+# R-258195 RHEL-09-654105
+rhel9STIG_stigrule_258195_Manage: True
+rhel9STIG_stigrule_258195__etc_audit_rules_d_audit_rules__usr_bin_kmod_Line: '-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules'
+# R-258196 RHEL-09-654110
+rhel9STIG_stigrule_258196_Manage: True
+rhel9STIG_stigrule_258196__etc_audit_rules_d_audit_rules__usr_bin_newgrp_Line: '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
+# R-258197 RHEL-09-654115
+rhel9STIG_stigrule_258197_Manage: True
+rhel9STIG_stigrule_258197__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check_Line: '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check'
+# R-258198 RHEL-09-654120
+rhel9STIG_stigrule_258198_Manage: True
+rhel9STIG_stigrule_258198__etc_audit_rules_d_audit_rules__usr_bin_passwd_Line: '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd'
+# R-258199 RHEL-09-654125
+rhel9STIG_stigrule_258199_Manage: True
+rhel9STIG_stigrule_258199__etc_audit_rules_d_audit_rules__usr_sbin_postdrop_Line: '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258200 RHEL-09-654130
+rhel9STIG_stigrule_258200_Manage: True
+rhel9STIG_stigrule_258200__etc_audit_rules_d_audit_rules__usr_sbin_postqueue_Line: '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258201 RHEL-09-654135
+rhel9STIG_stigrule_258201_Manage: True
+rhel9STIG_stigrule_258201__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent_Line: '-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'
+# R-258202 RHEL-09-654140
+rhel9STIG_stigrule_258202_Manage: True
+rhel9STIG_stigrule_258202__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign_Line: '-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh'
+# R-258203 RHEL-09-654145
+rhel9STIG_stigrule_258203_Manage: True
+rhel9STIG_stigrule_258203__etc_audit_rules_d_audit_rules__usr_bin_su_Line: '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change'
+# R-258204 RHEL-09-654150
+rhel9STIG_stigrule_258204_Manage: True
+rhel9STIG_stigrule_258204__etc_audit_rules_d_audit_rules__usr_bin_sudo_Line: '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
+# R-258205 RHEL-09-654155
+rhel9STIG_stigrule_258205_Manage: True
+rhel9STIG_stigrule_258205__etc_audit_rules_d_audit_rules__usr_bin_sudoedit_Line: '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd'
+# R-258206 RHEL-09-654160
+rhel9STIG_stigrule_258206_Manage: True
+rhel9STIG_stigrule_258206__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd_Line: '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258207 RHEL-09-654165
+rhel9STIG_stigrule_258207_Manage: True
+rhel9STIG_stigrule_258207__etc_audit_rules_d_audit_rules__usr_sbin_unix_update_Line: '-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258208 RHEL-09-654170
+rhel9STIG_stigrule_258208_Manage: True
+rhel9STIG_stigrule_258208__etc_audit_rules_d_audit_rules__usr_sbin_userhelper_Line: '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update'
+# R-258209 RHEL-09-654175
+rhel9STIG_stigrule_258209_Manage: True
+rhel9STIG_stigrule_258209__etc_audit_rules_d_audit_rules__usr_sbin_usermod_Line: '-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod'
+# R-258210 RHEL-09-654180
+rhel9STIG_stigrule_258210_Manage: True
+rhel9STIG_stigrule_258210__etc_audit_rules_d_audit_rules__usr_bin_mount_Line: '-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount'
+# R-258211 RHEL-09-654185
+rhel9STIG_stigrule_258211_Manage: True
+rhel9STIG_stigrule_258211__etc_audit_rules_d_audit_rules__usr_sbin_init_Line: '-a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init'
+# R-258212 RHEL-09-654190
+rhel9STIG_stigrule_258212_Manage: True
+rhel9STIG_stigrule_258212__etc_audit_rules_d_audit_rules__usr_sbin_poweroff_Line: '-a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff'
+# R-258213 RHEL-09-654195
+rhel9STIG_stigrule_258213_Manage: True
+rhel9STIG_stigrule_258213__etc_audit_rules_d_audit_rules__usr_sbin_reboot_Line: '-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot'
+# R-258214 RHEL-09-654200
+rhel9STIG_stigrule_258214_Manage: True
+rhel9STIG_stigrule_258214__etc_audit_rules_d_audit_rules__usr_sbin_shutdown_Line: '-a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown'
+# R-258217 RHEL-09-654215
+rhel9STIG_stigrule_258217_Manage: True
+rhel9STIG_stigrule_258217__etc_audit_rules_d_audit_rules__etc_sudoers_Line: '-w /etc/sudoers -p wa -k identity'
+# R-258218 RHEL-09-654220
+rhel9STIG_stigrule_258218_Manage: True
+rhel9STIG_stigrule_258218__etc_audit_rules_d_audit_rules__etc_sudoers_d__Line: '-w /etc/sudoers.d/ -p wa -k identity'
+# R-258219 RHEL-09-654225
+rhel9STIG_stigrule_258219_Manage: True
+rhel9STIG_stigrule_258219__etc_audit_rules_d_audit_rules__etc_group_Line: '-w /etc/group -p wa -k identity'
+# R-258220 RHEL-09-654230
+rhel9STIG_stigrule_258220_Manage: True
+rhel9STIG_stigrule_258220__etc_audit_rules_d_audit_rules__etc_gshadow_Line: '-w /etc/gshadow -p wa -k identity'
+# R-258221 RHEL-09-654235
+rhel9STIG_stigrule_258221_Manage: True
+rhel9STIG_stigrule_258221__etc_audit_rules_d_audit_rules__etc_security_opasswd_Line: '-w /etc/security/opasswd -p wa -k identity'
+# R-258222 RHEL-09-654240
+rhel9STIG_stigrule_258222_Manage: True
+rhel9STIG_stigrule_258222__etc_audit_rules_d_audit_rules__etc_passwd_Line: '-w /etc/passwd -p wa -k identity'
+# R-258223 RHEL-09-654245
+rhel9STIG_stigrule_258223_Manage: True
+rhel9STIG_stigrule_258223__etc_audit_rules_d_audit_rules__etc_shadow_Line: '-w /etc/shadow -p wa -k identity'
+# R-258224 RHEL-09-654250
+rhel9STIG_stigrule_258224_Manage: True
+rhel9STIG_stigrule_258224__etc_audit_rules_d_audit_rules__var_log_faillock_Line: '-w /var/log/faillock -p wa -k logins'
+# R-258225 RHEL-09-654255
+rhel9STIG_stigrule_258225_Manage: True
+rhel9STIG_stigrule_258225__etc_audit_rules_d_audit_rules__var_log_lastlog_Line: '-w /var/log/lastlog -p wa -k logins'
+# R-258226 RHEL-09-654260
+rhel9STIG_stigrule_258226_Manage: True
+rhel9STIG_stigrule_258226__etc_audit_rules_d_audit_rules__var_log_tallylog_Line: '-w /var/log/tallylog -p wa -k logins'
+# R-258227 RHEL-09-654265
+rhel9STIG_stigrule_258227_Manage: True
+rhel9STIG_stigrule_258227__etc_audit_rules_d_audit_rules_f2_Line: '-f 2'
+# R-258228 RHEL-09-654270
+rhel9STIG_stigrule_258228_Manage: True
+rhel9STIG_stigrule_258228__etc_audit_rules_d_audit_rules_loginuid_immutable_Line: '--loginuid-immutable'
+# R-258229 RHEL-09-654275
+rhel9STIG_stigrule_258229_Manage: True
+rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line: '-e 2'
+# R-258234 RHEL-09-215100
+rhel9STIG_stigrule_258234_Manage: True
+rhel9STIG_stigrule_258234_crypto_policies_State: installed
+# R-272488 RHEL-09-215101
+rhel9STIG_stigrule_272488_Manage: True
+rhel9STIG_stigrule_272488_postfix_State: installed

collections/ansible_collections/demo/compliance/roles/rhel9STIG/handlers/main.yml

@@ -0,0 +1,30 @@
+- name: dconf_update
+  command: dconf update
+- name: auditd_restart
+  command: /usr/sbin/service auditd restart
+- name: ssh_restart
+  service:
+    name: sshd
+    state: restarted
+- name: rsyslog_restart
+  service:
+    name: rsyslog
+    state: restarted
+- name: sysctl_load_settings
+  command: sysctl --system
+- name: daemon_reload
+  systemd:
+    daemon_reload: true
+- name: networkmanager_reload
+  service:
+    name: NetworkManager
+    state: reloaded
+- name: logind_restart
+  service:
+    name: systemd-logind
+    state: restarted
+- name: with_faillock_enable
+  command: authselect enable-feature with-faillock
+- name: do_reboot
+  reboot:
+    pre_reboot_delay: 60

collections/ansible_collections/demo/openshift/roles/cluster_config/README.md

@@ -0,0 +1,131 @@
+Role Name
+=========
+
+This Ansible role helps configure Operators on the Openshift Cluster to support VM migrations. Tasks include
+- Configure Catalog Sources to use mirroring repository for Operators
+- Create and configure Operators
+
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+The task `operators/catalog_sources.yml` needs following variables:
+
+- **Variable Name**: `cluster_config_catalog_sources`
+  - **Type**: List
+  - **Description**: A list of custom CatalogSources configurations used as loop variables to generate Kubernetes manifest files from the  template `catalog_source.j2` for CatalogSource. If the variable is not available, no manifest is created.
+  - **Example**:
+    ```yaml
+    cluster_config_catalog_sources:
+      - name: redhat-marketplace2
+        source_type: grpc
+        display_name: Mirror to Red Hat Marketplace
+        image_path: internal-registry.example.com/operator:v1
+        priority: '-300'
+        icon:
+          base64data: ''
+          mediatype: ''
+        publisher: redhat
+        address: ''
+        grpc_pod_config: |
+          nodeSelector:
+            kubernetes.io/os: linux
+            node-role.kubernetes.io/master: ''
+          priorityClassName: system-cluster-critical
+          securityContextConfig: restricted
+          tolerations:
+            - effect: NoSchedule
+              key: node-role.kubernetes.io/master
+              operator: Exists
+            - effect: NoExecute
+              key: node.kubernetes.io/unreachable
+              operator: Exists
+              tolerationSeconds: 120
+            - effect: NoExecute
+              key: node.kubernetes.io/not-ready
+              operator: Exists
+              tolerationSeconds: 120
+        registry_poll_interval: 10m
+    ```
+
+The task `operators/operator_config.yaml` needs following variables:
+
+- **Variable Name**: `cluster_config_operators`
+  - **Type**: List
+  - **Description**: A list of operators to be installed on OCP cluster
+- **Variable Name**: `cluster_config_[OPERATOR_NAME]`
+  - **Type**: Dict
+  - **Description**: Configuration specific to each operator listed in `cluster_config_operators`. Includes settings for namespace, operator group, subscription, and any extra resources
+  - **Example**: Assume the `cluster_config_operators` specifies these operators:
+  ```yaml
+  cluster_config_operators:
+    - cnv
+    - oadp
+  ```
+  then the corresponding `cluster_config_mtv` and `cluster_config_cnv` can be configured as following:
+  ```yaml
+  cluster_config_cnv_namespace: openshift-cnv
+  cluster_config_cnv:
+  namespace:
+    name: "{{ cluster_config_cnv_namespace }}"
+  operator_group:
+    name: kubevirt-hyperconverged-group
+    target_namespaces:
+      - "{{ cluster_config_cnv_namespace }}"
+  subscription:
+    name: kubevirt-hyperconverged
+    starting_csv: kubevirt-hyperconverged-operator.v4.13.8
+  extra_resources:
+    - apiVersion: hco.kubevirt.io/v1beta1
+      kind: HyperConverged
+      metadata:
+        name: kubevirt-hyperconverged
+        namespace: "{{ cluster_config_cnv_namespace }}"
+      spec:
+        BareMetalPlatform: true
+
+  cluster_config_oadp_namespace: openshift-adp
+  cluster_config_oadp:
+  namespace:
+    name: "{{ cluster_config_oadp_namespace }}"
+  operator_group:
+    name: redhat-oadp-operator-group
+    target_namespaces:
+      - "{{ cluster_config_oadp_namespace }}"
+  subscription:
+    name: redhat-oadp-operator-subscription
+    spec_name: redhat-oadp-operator
+  ```
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+An example of configuring a CatalogSource resource:
+```
+- name: Configure Catalog Sources for Operators
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - ansible.builtin.include_role:
+        name: cluster_config
+        tasks_from: operators/catalog_sources
+```
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

collections/ansible_collections/demo/openshift/roles/cluster_config/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+# defaults file for cluster_config
+cluster_config_operators:
+  - cnv
+
+cluster_config_cnv:
+  checkplan: true
+  namespace:
+    name: &cluster_config_cnv_namespace openshift-cnv
+  operator_group:
+    name: kubevirt-hyperconverged-group
+    target_namespaces:
+      - *cluster_config_cnv_namespace
+  subscription:
+    name: kubevirt-hyperconverged
+  extra_resources:
+    - apiVersion: hco.kubevirt.io/v1beta1
+      kind: HyperConverged
+      metadata:
+        name: kubevirt-hyperconverged
+        namespace: *cluster_config_cnv_namespace
+      spec:
+        BareMetalPlatform: true

collections/ansible_collections/demo/openshift/roles/cluster_config/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for cluster_config

collections/ansible_collections/demo/openshift/roles/cluster_config/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: Configure Operators
+  ansible.builtin.import_tasks: operators/operator_config.yml

collections/ansible_collections/demo/openshift/roles/cluster_config/tasks/operators/_operator_config_item.yml

@@ -0,0 +1,37 @@
+---
+- name: Retrieve Operator name
+  ansible.builtin.set_fact:
+    _operator: "{{ vars['cluster_config_' + _operator_name] }}"
+- name: Configure Operator {{ _operator_name }}
+  redhat.openshift.k8s:
+    state: present
+    template:
+      - operators/namespace.yml.j2
+      - operators/operator_group.yml.j2
+      - operators/subscription.yml.j2
+- name: Query for install plan
+  kubernetes.core.k8s_info:
+    api_version: operators.coreos.com/v1alpha1
+    kind: InstallPlan
+    namespace: "{{ _operator.namespace.name }}"
+  register: r_install_plans
+  retries: 30
+  delay: 5
+  until:
+    - r_install_plans.resources | default([]) | length > 0
+    - r_install_plans.resources[0].status is defined
+    - r_install_plans.resources[0].status.phase == "Complete"
+  when:
+    - _operator.checkplan is defined
+    - _operator.checkplan | bool
+
+- name: Configure extra resources for Operator {{ _operator_name }}
+  redhat.openshift.k8s:
+    state: present
+    definition: "{{ item }}"
+  register: creation_result
+  loop: "{{ _operator.extra_resources }}"
+  retries: 30
+  delay: 5
+  until: creation_result is success
+  when: _operator.extra_resources is defined

collections/ansible_collections/demo/openshift/roles/cluster_config/tasks/operators/catalog_sources.yml

@@ -0,0 +1,7 @@
+---
+- name: Configure custom CatalogSource for Operators
+  redhat.openshift.k8s:
+    state: present
+    template: operators/catalog_source.j2
+  loop: "{{ cluster_config_catalog_sources }}"
+  when: cluster_config_catalog_sources is defined

collections/ansible_collections/demo/openshift/roles/cluster_config/tasks/operators/node-health-check.yml

@@ -0,0 +1,59 @@
+---
+- name: Create node-health-check operator namespace
+  redhat.openshift.k8s:
+    name:  openshift-workload-availability
+    api_version: v1
+    kind: Namespace
+    state: present
+
+- name: Create node-health-check operator group
+  redhat.openshift.k8s:
+    state: present
+    definition:
+      apiVersion: operators.coreos.com/v1
+      kind: OperatorGroup
+      metadata:
+        generateName: openshift-workload-availability-
+        annotations:
+          olm.providedAPIs: >-
+            NodeHealthCheck.v1alpha1.remediation.medik8s.io,SelfNodeRemediation.v1alpha1.self-node-remediation.medik8s.io,SelfNodeRemediationConfig.v1alpha1.self-node-remediation.medik8s.io,SelfNodeRemediationTemplate.v1alpha1.self-node-remediation.medik8s.io
+        namespace: openshift-workload-availability
+      spec:
+        upgradeStrategy: Default
+
+- name: Create node-health-check operator subscription
+  redhat.openshift.k8s:
+    state: present
+    definition:
+      apiVersion: operators.coreos.com/v1alpha1
+      kind: Subscription
+      metadata:
+        labels:
+          operators.coreos.com/node-healthcheck-operator.openshift-workload-availability: ''
+        name: node-health-check-operator
+        namespace: openshift-workload-availability
+      spec:
+        channel: stable
+        installPlanApproval: Automatic
+        name: node-healthcheck-operator
+        source: redhat-operators
+        sourceNamespace: openshift-marketplace
+
+- name: Create Self Node Remediation subscription
+  redhat.openshift.k8s:
+    state: present
+    definition:
+      apiVersion: operators.coreos.com/v1alpha1
+      kind: Subscription
+      metadata:
+        name: self-node-remediation-stable-redhat-operators-openshift-marketplace
+        namespace: openshift-workload-availability
+        labels:
+          operators.coreos.com/self-node-remediation.openshift-workload-availability: ''
+      spec:
+        channel: stable
+        installPlanApproval: Automatic
+        name: self-node-remediation
+        source: redhat-operators
+        sourceNamespace: openshift-marketplace
+        startingCSV: self-node-remediation.v0.8.0

collections/ansible_collections/demo/openshift/roles/cluster_config/tasks/operators/operator_config.yml

@@ -0,0 +1,6 @@
+---
+- name: Configure Operators
+  ansible.builtin.include_tasks: _operator_config_item.yml
+  loop: "{{ cluster_config_operators }}"
+  loop_control:
+    loop_var: _operator_name

collections/ansible_collections/demo/openshift/roles/cluster_config/templates/operators/catalog_source.j2

@@ -0,0 +1,34 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: CatalogSource
+metadata:
+  name: {{ item.name }}
+  namespace: openshift-marketplace
+spec:
+  sourceType: {{ item.source_type | d('grpc',true) }}
+  image: {{ item.image_path }}
+  {% if item.display_name is defined -%}
+  displayName: {{ item.display_name }}
+  {% endif -%}
+  {% if item.priority is defined -%}
+  priority: {{ item.priority }}
+  {% endif -%}
+  {% if item.grpc_pod_config is defined -%}
+  grpcPodConfig:
+    {{ item.grpc_pod_config | indent(4) }}
+  {% endif -%}
+  {% if item.icon is defined -%}
+  icon:
+    base64data: '{{ item.icon.base64data or ''  }}'
+    mediatype: '{{ item.icon.mediatype or '' }}'
+  {% endif -%}
+  {% if item.publisher is defined -%}
+  publisher: {{ item.publisher }}
+  {% endif -%}
+  {% if item.address is defined -%}
+  address: {{ item.address }}
+  {% endif -%}
+  {% if item.registry_poll_interval is defined -%}
+  updateStrategy:
+    registryPoll:
+      interval: {{ item.registry_poll_interval }}
+  {% endif -%}

collections/ansible_collections/demo/openshift/roles/cluster_config/templates/operators/namespace.yml.j2

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: {{ _operator.namespace.name }}
+{% if _operator.namespace.labels is defined %}
+    labels:
+      {% for key, value in _operator.namespace.labels.items() -%}
+      {{ key }}: "{{ value }}"
+      {% endfor -%}
+{% endif -%}

collections/ansible_collections/demo/openshift/roles/cluster_config/templates/operators/operator_group.yml.j2

@@ -0,0 +1,12 @@
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: {{ _operator.operator_group.name }}
+  namespace: {{ _operator.operator_group.namespace | d(_operator.namespace.name, true) }}
+spec:
+  {% if _operator.operator_group.target_namespaces is defined -%}
+  targetNamespaces:
+  {% for item in _operator.operator_group.target_namespaces %}
+    - {{ item }}
+  {% endfor %}
+  {% endif -%}

collections/ansible_collections/demo/openshift/roles/cluster_config/templates/operators/subscription.yml.j2

@@ -0,0 +1,14 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: {{ _operator.subscription.name }}
+  namespace: "{{ _operator.subscription.namespace | d(_operator.namespace.name, true) }}"
+spec:
+  channel: {{ _operator.subscription.channel | d('stable', true) }}
+  installPlanApproval: {{ _operator.subscription.install_plan_approval | d('Automatic', true) }}
+  name: {{ _operator.subscription.spec_name | d(_operator.subscription.name, true) }}
+  source: {{ _operator.subscription.source | d('redhat-operators', true) }}
+  sourceNamespace: {{ _operator.subscription.source_namespace | d('openshift-marketplace', true) }}
+{% if _operator.subscription.starting_csv is defined %}
+  startingCSV: {{ _operator.subscription.starting_csv }}
+{% endif -%}

collections/ansible_collections/demo/openshift/roles/cluster_config/tests/inventory

@@ -0,0 +1 @@
+localhost

collections/ansible_collections/demo/openshift/roles/cluster_config/tests/test.yml

@@ -0,0 +1,6 @@
+---
+- name: Include cluster_config role
+  hosts: localhost
+  remote_user: root
+  roles:
+    - cluster_config

collections/ansible_collections/demo/openshift/roles/cluster_config/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for cluster_config

collections/ansible_collections/demo/openshift/roles/eda_controller/.yamllint

@@ -0,0 +1,13 @@
+---
+extends: default
+
+rules:
+  comments:
+    require-starting-space: false
+    min-spaces-from-content: 1
+  comments-indentation: disable
+  indentation:
+    indent-sequences: consistent
+  line-length:
+    max: 120
+    allow-non-breakable-inline-mappings: true

collections/ansible_collections/demo/openshift/roles/eda_controller/defaults/main.yml

@@ -0,0 +1,16 @@
+---
+# --------------------------------------------------------
+# Ansible Automation Platform Controller URL
+# --------------------------------------------------------
+# eda_controller_aap_controller_url: [Required]
+
+# --------------------------------------------------------
+# Workload: eda_controller
+# --------------------------------------------------------
+eda_controller_project: "aap"
+eda_controller_project_app_name: "eda-controller"
+
+# eda_controller_admin_password: "{{ common_password }}"
+
+eda_controller_cluster_rolebinding_name: eda_default
+eda_controller_cluster_rolebinding_role: cluster-admin

collections/ansible_collections/demo/openshift/roles/eda_controller/meta/main.yml

@@ -0,0 +1,14 @@
+---
+galaxy_info:
+  role_name: eda_controller
+  author: Mitesh Sharma (mitsharm@redhat.com)
+  description: |
+    Installs EDA on OpenShift
+  license: GPLv3
+  min_ansible_version: "2.9"
+  platforms: []
+  galaxy_tags:
+    - eda
+    - openshift
+    - aap
+dependencies: []

collections/ansible_collections/demo/openshift/roles/eda_controller/readme.adoc

@@ -0,0 +1,6 @@
+== eda_controller
+
+This role installs EDA on OpenShift, mostly copied from https://github.com/redhat-cop/agnosticd/.
+
+== Dependencies
+Role: automation_controller_platform

collections/ansible_collections/demo/openshift/roles/eda_controller/tasks/main.yml

@@ -0,0 +1,54 @@
+---
+- name: Setup environment vars
+  block:
+    - name: Create secret and Install EDA
+      kubernetes.core.k8s:
+        state: present
+        definition: "{{ lookup('template', __definition) }}"
+      loop:
+        - eda_admin_secret.j2
+        - eda_controller.j2
+      loop_control:
+        loop_var: __definition
+
+    - name: Retrieve created route
+      kubernetes.core.k8s_info:
+        api_version: "route.openshift.io/v1"
+        kind: Route
+        name: "{{ eda_controller_project_app_name }}"
+        namespace: "{{ eda_controller_project }}"
+      register: eda_controller_r_eda_route
+      until: eda_controller_r_eda_route.resources[0].spec.host is defined
+      retries: 30
+      delay: 45
+
+    - name: Get eda-controller route hostname
+      ansible.builtin.set_fact:
+        eda_controller_hostname: "{{ eda_controller_r_eda_route.resources[0].spec.host }}"
+
+    - name: Wait for eda_controller to be running
+      ansible.builtin.uri:
+        url: https://{{ eda_controller_hostname }}/api/eda/v1/users/me/awx-tokens/
+        user: "admin"
+        password: "{{ lookup('ansible.builtin.env', 'CONTROLLER_PASSWORD') }}"
+        method: GET
+        force_basic_auth: true
+        validate_certs: false
+        body_format: json
+        status_code: 200
+      register: eda_controller_r_result
+      until: not eda_controller_r_result.failed
+      retries: 60
+      delay: 45
+
+    - name: Create Rolebinding for Rulebook Activations
+      kubernetes.core.k8s:
+        state: present
+        definition: "{{ lookup('template', 'cluster_rolebinding.j2') }}"
+
+    - name: Display EDA Controller URL
+      ansible.builtin.debug:
+        msg:
+          - "EDA Controller URL: https://{{ eda_controller_hostname }}"
+          - "EDA Controller Admin Login: admin"
+          - "EDA Controller Admin Password: <same as the Controller Admin password>"

collections/ansible_collections/demo/openshift/roles/eda_controller/templates/cluster_rolebinding.j2

@@ -0,0 +1,13 @@
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ eda_controller_cluster_rolebinding_name }}
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: {{ eda_controller_project }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ eda_controller_cluster_rolebinding_role }}

collections/ansible_collections/demo/openshift/roles/eda_controller/templates/eda_admin_secret.j2

@@ -0,0 +1,15 @@
+---
+kind: Secret
+apiVersion: v1
+metadata:
+  name: {{ eda_controller_project_app_name }}-admin-password
+  namespace: {{ eda_controller_project }}
+  labels:
+    app.kubernetes.io/component: eda
+    app.kubernetes.io/managed-by: eda-operator
+    app.kubernetes.io/name: {{ eda_controller_project_app_name }}
+    app.kubernetes.io/operator-version: '2.4'
+    app.kubernetes.io/part-of: {{ eda_controller_project_app_name }}
+data:
+  password: "{{ lookup('ansible.builtin.env', 'CONTROLLER_PASSWORD') | b64encode }}"
+type: Opaque

collections/ansible_collections/demo/openshift/roles/eda_controller/templates/eda_controller.j2

@@ -0,0 +1,26 @@
+---
+apiVersion: eda.ansible.com/v1alpha1
+kind: EDA
+metadata:
+  name: {{ eda_controller_project_app_name }}
+  namespace: {{ eda_controller_project }}
+spec:
+  route_tls_termination_mechanism: Edge
+  ingress_type: Route
+  loadbalancer_port: 80
+  no_log: true
+  image_pull_policy: IfNotPresent
+  ui:
+    replicas: 1
+  set_self_labels: true
+  api:
+    gunicorn_workers: 2
+    replicas: 1
+  redis:
+    replicas: 1
+  admin_user: admin
+  loadbalancer_protocol: http
+  worker:
+    replicas: 3
+  automation_server_url: '{{ lookup('ansible.builtin.env', 'CONTROLLER_HOST') }}'
+  admin_password_secret: {{ eda_controller_project_app_name }}-admin-password

collections/ansible_collections/demo/openshift/roles/snapshot/tasks/create.yml

@@ -0,0 +1,49 @@
+---
+- name: Get state of VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm_info:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+  register: snapshot_state
+
+- name: Stop VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: false
+    wait: true
+  when: snapshot_state.resources.0.spec.running
+
+- name: Create a VirtualMachineSnapshot
+  kubernetes.core.k8s:
+    definition:
+      apiVersion: snapshot.kubevirt.io/v1alpha1
+      kind: VirtualMachineSnapshot
+      metadata:
+        generateName: "{{ item }}-{{ ansible_date_time.epoch }}"
+        namespace: "{{ vm_namespace }}"
+      spec:
+        source:
+          apiGroup: kubevirt.io
+          kind: VirtualMachine
+          name: "{{ item }}"
+    wait: true
+    wait_condition:
+      type: Ready
+  register: snapshot_snapshot
+
+- name: Start VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: true
+    wait: true
+  when: snapshot_state.resources.0.spec.running
+
+- name: Export snapshot name
+  ansible.builtin.set_stats:
+    data:
+      restore_snapshot_name: "{{ snapshot_snapshot.result.metadata.name }}"
+
+- name: Output snapshot name
+  ansible.builtin.debug:
+    msg: "Successfully created snapshot {{ snapshot_snapshot.result.metadata.name }}"

collections/ansible_collections/demo/openshift/roles/snapshot/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+# parameters
+# snapshot_opeation: <ceate/restore>
+- name: Show hostnames we care about
+  ansible.builtin.debug:
+    msg: "About to {{ snapshot_operation }} snapshot(s) for the following hosts:
+{{ lookup('ansible.builtin.inventory_hostnames', snapshot_hosts) | split(',') | difference(['localhost']) }}"
+
+- name: Manage snapshots based on operation
+  ansible.builtin.include_tasks:
+    file: "{{ snapshot_operation }}.yml"
+  loop: "{{ lookup('ansible.builtin.inventory_hostnames', snapshot_hosts) | regex_replace(vm_namespace + '-', '') | split(',') | difference(['localhost']) }}"

collections/ansible_collections/demo/openshift/roles/snapshot/tasks/restore.yml

@@ -0,0 +1,51 @@
+---
+- name: Get state of VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm_info:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+  register: snapshot_state
+
+- name: List snapshots
+  kubernetes.core.k8s_info:
+    api_version: snapshot.kubevirt.io/v1alpha1
+    kind: VirtualMachineSnapshot
+    namespace: "{{ vm_namespace }}"
+  register: snapshot_snapshot
+
+- name: Set snapshot name for {{ item }}
+  ansible.builtin.set_fact:
+    snapshot_latest_snapshot: "{{ snapshot_snapshot.resources | selectattr('spec.source.name', 'equalto', item) | sort(attribute='metadata.creationTimestamp') | first }}"
+
+- name: Stop VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: false
+    wait: true
+  when: snapshot_state.resources.0.spec.running
+
+- name: Restore a VirtualMachineSnapshot
+  kubernetes.core.k8s:
+    definition:
+      apiVersion: snapshot.kubevirt.io/v1alpha1
+      kind: VirtualMachineRestore
+      metadata:
+        generateName: "{{ snapshot_latest_snapshot.metadata.generateName }}"
+        namespace: "{{ vm_namespace }}"
+      spec:
+        target:
+          apiGroup: kubevirt.io
+          kind: VirtualMachine
+          name: "{{ item }}"
+        virtualMachineSnapshotName: "{{ snapshot_latest_snapshot.metadata.name }}"
+    wait: true
+    wait_condition:
+      type: Ready
+
+- name: Start VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: true
+    wait: true
+  when: snapshot_state.resources.0.spec.running

collections/ansible_collections/demo/patching/roles/build_report_network/tasks/main.yml

@@ -6,32 +6,34 @@
     mode: "0755"
 
 - name: Create HTML report
+  check_mode: false
   ansible.builtin.template:
     src: report.j2
     dest: "{{ file_path }}/network.html"
     mode: "0644"
-  check_mode: false
 
 - name: Copy CSS over
+  check_mode: false
   ansible.builtin.copy:
     src: "css"
     dest: "{{ file_path }}"
     directory_mode: true
     mode: "0775"
-  check_mode: false
 
 - name: Copy logos over
-  ansible.builtin.copy:
-    src: "{{ item }}"
-    dest: "{{ file_path }}"
-    directory_mode: true
-    mode: "0644"
   loop:
     - "webpage_logo.png"
     - "redhat-ansible-logo.svg"
     - "router.png"
+  loop_control:
+    loop_var: logo
   check_mode: false
+  ansible.builtin.copy:
+    src: "{{ logo }}"
+    dest: "{{ file_path }}"
+    directory_mode: true
+    mode: "0644"
 
-# - name: Display link to Linux patch report
-#   ansible.builtin.debug:
-#     msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/network.html"
+- name: Display link to Linux patch report
+  ansible.builtin.debug:
+    msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/network.html"

collections/ansible_collections/demo/patching/roles/patch_linux/tasks/main.yml

@@ -8,12 +8,12 @@
   check_mode: false
 
 - name: Upgrade packages (yum)
-  ansible.builtin.yum:
+  ansible.legacy.dnf:
     name: '*'
     state: latest  # noqa: package-latest - Intended to update packages to latest
     exclude: "{{ exclude_packages }}"
   when: ansible_pkg_mgr == "yum"
-  register: patchingresult_yum
+  register: patch_linux_patchingresult_yum
 
 - name: Upgrade packages (dnf)
   ansible.builtin.dnf:
@@ -21,17 +21,17 @@
     state: latest  # noqa: package-latest - Intended to update packages to latest
     exclude: "{{ exclude_packages }}"
   when: ansible_pkg_mgr == "dnf"
-  register: patchingresult_dnf
+  register: patch_linux_patchingresult_dnf
 
 - name: Check to see if we need a reboot
   ansible.builtin.command: needs-restarting -r
-  register: result
-  changed_when: result.rc == 1
-  failed_when: result.rc > 1
+  register: patch_linux_result
+  changed_when: patch_linux_result.rc == 1
+  failed_when: patch_linux_result.rc > 1
   check_mode: false
 
 - name: Reboot Server if Necessary
   ansible.builtin.reboot:
   when:
-    - result.rc == 1
+    - patch_linux_result.rc == 1
     - allow_reboot

collections/ansible_collections/demo/patching/roles/patch_windows/tasks/main.yml

@@ -12,4 +12,4 @@
     category_names: "{{ win_update_categories | default(omit) }}"
     reboot: "{{ allow_reboot }}"
     state: installed
-  register: patchingresult
+  register: patch_windows_patchingresult

collections/ansible_collections/demo/patching/roles/report_linux/tasks/main.yml

@@ -31,3 +31,7 @@
 - name: Display link to inventory report
   ansible.builtin.debug:
     msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html"
+
+- name: Display link with a new path
+  ansible.builtin.debug:
+    msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html"

collections/ansible_collections/demo/patching/roles/report_linux_patching/templates/report.j2

@@ -35,17 +35,17 @@
             <td>{{hostvars[linux_host]['ansible_distribution_version']|default("none")}}</td>
             <td>
               <ul>
-{% if hostvars[linux_host].patchingresult_yum.changed|default("false",true) == true %}
-{% for packagename in hostvars[linux_host].patchingresult_yum.changes.updated|sort %}
+{% if hostvars[linux_host].patch_linux_patchingresult_yum.changed|default("false",true) == true %}
+{% for packagename in hostvars[linux_host].patch_linux_patchingresult_yum.changes.updated|sort %}
         <li> {{ packagename[0] }} - {{ packagename[1] }} </li>
 {% endfor %}
-{% elif hostvars[linux_host].patchingresult_dnf.changed|default("false",true) == true %}
-{% for packagename in hostvars[linux_host].patchingresult_dnf.results|sort %}
+{% elif hostvars[linux_host].patch_linux_patchingresult_dnf.changed|default("false",true) == true %}
+{% for packagename in hostvars[linux_host].patch_linux_patchingresult_dnf.results|sort %}
         <li> {{ packagename }} </li>
 {% endfor %}
-{% elif hostvars[linux_host].patchingresult_dnf.changed is undefined %}
+{% elif hostvars[linux_host].patch_linux_patchingresult_dnf.changed is undefined %}
         <li> Patching Failed </li>
-{% elif hostvars[linux_host].patchingresult_yum.changed is undefined %}
+{% elif hostvars[linux_host].patch_linux_patchingresult_yum.changed is undefined %}
         <li> Patching Failed </li>
 {% else %}
         <li> Compliant </li>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/README.md

@@ -0,0 +1,36 @@
+build_report_linux_patch
+========
+
+Installs Apache and creates a report based on facts from Linux patching
+
+Requirements
+------------
+
+Must run on Apache server
+
+Role Variables / Configuration
+--------------
+
+N/A
+
+Dependencies
+------------
+
+N/A
+
+Example Playbook
+----------------
+
+The role can be used to create an html report on any number of Linux hosts using any number of Linux servers about their patching results(yum and dnf)
+
+
+```
+---
+- hosts: all
+
+  tasks:
+  - name: Run Windows Report
+    import_role:
+      name: shadowman.reports.build_report_linux_patch
+
+```

collections/ansible_collections/demo/patching/roles/report_ocp_patching/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+email_from: tower@shadowman.dev  # noqa var-naming[no-role-prefix] - TODO : we should rework roles to use variable prefix, until scope is defined, silence is the way
+to_emails: alex@shadowman.dev,tower@shadowman.dev  # noqa var-naming[no-role-prefix] - TODO : we should rework roles to use variable prefix, until scope is defined, silence is the way
+to_emails_list: "{{ to_emails.split(',') }}"  # noqa var-naming[no-role-prefix] - TODO : we should rework roles to use variable prefix, until scope is defined, silence is the way
+detailedreport: true  # noqa var-naming[no-role-prefix] - TODO : we should rework roles to use variable prefix, until scope is defined, silence is the way
+reports:  # noqa var-naming[no-role-prefix] - TODO : we should rework roles to use variable prefix, until scope is defined, silence is the way
+  - linux.html
+  - linuxpatch.html

collections/ansible_collections/demo/patching/roles/report_ocp_patching/files/new.css

@@ -0,0 +1,202 @@
+p.hostname {
+    color: #000000;
+    font-weight: bolder;
+    font-size: large;
+    margin: auto;
+    width: 50%;
+  }
+
+  #subtable {
+    background: #ebebeb;
+    margin: 0px;
+    width: 100%;
+  }
+
+  #subtable tbody tr td {
+    padding: 5px 5px 5px 5px;
+  }
+
+  #subtable thead th {
+    padding: 5px;
+  }
+
+  * {
+    -moz-box-sizing: border-box;
+    -webkit-box-sizing: border-box;
+    box-sizing: border-box;
+    font-family: "Open Sans", "Helvetica";
+
+  }
+
+  a {
+    color: #ffffff;
+  }
+
+  p {
+    color: #ffffff;
+  }
+  h1 {
+    text-align: center;
+    color: #ffffff;
+  }
+
+  body {
+    background:#353a40;
+    padding: 0px;
+    margin: 0px;
+    font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
+  }
+
+  table {
+    border-collapse: separate;
+    background:#fff;
+    @include border-radius(5px);
+    @include box-shadow(0px 0px 5px rgba(0,0,0,0.3));
+  }
+
+  .main_net_table {
+    margin:50px auto;
+  }
+
+  thead {
+    @include border-radius(5px);
+  }
+
+  thead th {
+    font-size:16px;
+    font-weight:400;
+    color:#fff;
+    @include text-shadow(1px 1px 0px rgba(0,0,0,0.5));
+    text-align:left;
+    padding:20px;
+    border-top:1px solid #858d99;
+    background: #353a40;
+
+    &:first-child {
+     @include border-top-left-radius(5px);
+    }
+
+    &:last-child {
+      @include border-top-right-radius(5px);
+    }
+  }
+
+  tbody tr td {
+    font-weight:400;
+    color:#5f6062;
+    font-size:13px;
+    padding:20px 20px 20px 20px;
+    border-bottom:1px solid #e0e0e0;
+  }
+
+  tbody tr:nth-child(2n) {
+    background:#f0f3f5;
+  }
+
+  tbody tr:last-child td {
+    border-bottom:none;
+    &:first-child {
+      @include border-bottom-left-radius(5px);
+    }
+    &:last-child {
+      @include border-bottom-right-radius(5px);
+    }
+  }
+
+  td {
+    vertical-align: top;
+  }
+
+  span.highlight {
+      background-color: yellow;
+  }
+
+  .expandclass {
+    color: #5f6062;
+  }
+
+  .content{
+           display:none;
+           margin: 10px;
+  }
+
+  header {
+    width: 100%;
+    position: initial;
+    float: initial;
+    padding: 0;
+    margin: 0;
+    border-radius: 0;
+    height: 88px;
+    background-color: #171717;
+  }
+
+  .header-container {
+    margin: 0 auto;
+    width: 100%;
+    height: 100%;
+    max-width: 1170px;
+    padding: 0;
+    float: initial;
+    display: flex;
+    align-items: center;
+  }
+
+  .header-logo {
+    width: 137px;
+    border: 0;
+    margin: 0;
+    margin-left: 15px;
+  }
+
+  .header-link {
+    margin-left: 40px;
+    text-decoration: none;
+    cursor: pointer;
+    text-transform: uppercase;
+    font-size: 15px;
+    font-family: 'Red Hat Text';
+    font-weight: 500;
+  }
+
+  .header-link:hover {
+    text-shadow: 0 0 0.02px white;
+    text-decoration: none;
+  }
+
+  table.net_info td {
+    padding: 5px;
+}
+
+p.expandclass:hover {
+    text-decoration: underline;
+    color: #EE0000;
+    cursor: pointer;
+}
+
+.summary_info {
+}
+
+.ui-state-active, .ui-widget-content .ui-state-active, .ui-widget-header .ui-state-active, a.ui-button:active, .ui-button:active, .ui-button.ui-state-active:hover {
+    border: 1px solid #5F0000;
+    background: #EE0000;
+}
+
+div#net_content {
+    padding: 0px;
+    height: auto !important;
+}
+
+img.router_image {
+    vertical-align: middle;
+    padding: 0px 10px 10px 10px;
+    width: 50px;
+}
+
+table.net_info {
+    width: 100%;
+}
+
+p.internal_label {
+    color: #000000;
+}

collections/ansible_collections/demo/patching/roles/report_ocp_patching/files/redhat-ansible-logo.svg

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.0.3, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Logos" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="930.2px" height="350px" viewBox="0 0 930.2 350" style="enable-background:new 0 0 930.2 350;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#FFFFFF;}
+	.st1{fill:#EE0000;}
+</style>
+<title>Logo-Red_Hat-Ansible_Automation_Platform-A-Reverse-RGB</title>
+<path class="st0" d="M383.3,228.5h18.8L446,335.7h-17.5l-12.4-31.4h-48l-12.6,31.4h-16.7L383.3,228.5z M410.9,291l-18.7-47l-18.7,47
+	H410.9z"/>
+<path class="st0" d="M455.2,257.7h15.3v7.8c6.2-6.2,14.7-9.6,23.5-9.3c17.9,0,30.5,12.4,30.5,30.5v49h-15.3v-46.5
+	c0-12.3-7.5-19.8-19.3-19.8c-7.8-0.3-15.1,3.6-19.3,10.1v56.1h-15.3V257.7z"/>
+<path class="st0" d="M543,315.5c8.1,6.4,16.7,9.8,25.4,9.8c11,0,18.7-4.8,18.7-11.7c0-5.5-4-8.7-12.6-10l-14.1-2
+	c-15.5-2.3-23.3-9.5-23.3-21.6c0-14.1,12.3-23.6,30.5-23.6c11.3-0.1,22.3,3.4,31.5,9.9l-7.8,10.1c-8.6-5.7-16.4-8.1-24.7-8.1
+	c-9.3,0-15.6,4.3-15.6,10.6c0,5.7,3.7,8.4,12.9,9.8l14.1,2c15.5,2.3,23.6,9.7,23.6,21.7c0,14-14.1,24.5-32.6,24.5
+	c-13.5,0-25.6-4-34.2-11.5L543,315.5z"/>
+<path class="st0" d="M611.6,235.6c0-5.2,4.1-9.4,9.3-9.5c0,0,0,0,0,0c5.2-0.2,9.7,3.9,9.9,9.1c0.2,5.2-3.9,9.7-9.1,9.9
+	c-0.2,0-0.5,0-0.7,0C615.8,245.1,611.6,240.9,611.6,235.6C611.6,235.7,611.6,235.7,611.6,235.6z M628.6,335.7h-15.3v-78h15.3V335.7z
+	"/>
+<path class="st0" d="M685.5,336.9c-8.5,0-16.8-2.7-23.6-7.8v6.6h-15.2V228.5l15.3-3.4v40c6.6-5.6,15.1-8.7,23.7-8.6
+	c22.1,0,39.4,17.7,39.4,40.1C725.2,319.1,707.9,336.9,685.5,336.9z M662,279.2v35.2c4.9,5.7,13,9.2,21.8,9.2
+	c15,0,26.4-11.5,26.4-26.8c0-15.3-11.5-27-26.4-27C674.9,269.8,667.1,273.2,662,279.2z"/>
+<path class="st0" d="M755,335.7h-15.3V228.5l15.3-3.4V335.7z"/>
+<path class="st0" d="M810.5,337.1c-23,0-40.9-17.7-40.9-40.4c0-22.5,17.2-40.1,39.1-40.1c21.5,0,37.7,17.8,37.7,40.8v4.4h-61.6
+	c2,13,13.2,22.5,26.4,22.4c7.2,0.2,14.2-2.3,19.8-6.8l9.8,9.7C832.1,333.7,821.5,337.4,810.5,337.1z M784.9,290.2h46.3
+	c-2.3-11.9-11.5-20.8-22.8-20.8C796.5,269.4,787.2,277.8,784.9,290.2z"/>
+<path class="st1" d="M202.8,137.5c18.4,0,45.1-3.8,45.1-25.7c0.1-1.7-0.1-3.4-0.5-5l-11-47.7c-2.5-10.5-4.8-15.2-23.2-24.5
+	c-14.3-7.3-45.5-19.4-54.7-19.4c-8.6,0-11.1,11.1-21.3,11.1c-9.8,0-17.1-8.3-26.4-8.3c-8.8,0-14.6,6-19,18.4c0,0-12.4,34.9-14,40
+	c-0.3,0.9-0.4,1.9-0.4,2.9C77.6,92.9,131.1,137.5,202.8,137.5 M250.8,120.7c2.5,12.1,2.5,13.3,2.5,14.9c0,20.6-23.2,32.1-53.7,32.1
+	c-69,0-129.3-40.3-129.3-67c0-3.7,0.8-7.4,2.2-10.8c-24.8,1.3-56.9,5.7-56.9,34c0,46.4,109.9,103.5,196.9,103.5
+	c66.7,0,83.5-30.2,83.5-54C296.1,154.6,279.9,133.4,250.8,120.7"/>
+<path d="M250.7,120.7c2.5,12.1,2.5,13.3,2.5,14.9c0,20.6-23.2,32.1-53.7,32.1c-69,0-129.3-40.3-129.3-67c0-3.7,0.8-7.4,2.2-10.8
+	l5.4-13.3c-0.3,0.9-0.4,1.9-0.4,2.8c0,13.6,53.5,58.1,125.2,58.1c18.4,0,45.1-3.8,45.1-25.7c0.1-1.7-0.1-3.4-0.5-5L250.7,120.7z"/>
+<path class="st0" d="M869.1,151.2c0,17.5,10.5,26,29.7,26c5.9-0.1,11.8-1,17.5-2.5v-20.3c-3.7,1.2-7.5,1.7-11.3,1.7
+	c-7.9,0-10.8-2.5-10.8-9.9v-31.1h22.9V94.2h-22.9V67.7l-25,5.4v21.1h-16.6v20.9h16.6L869.1,151.2z M791,151.7
+	c0-5.4,5.4-8.1,13.6-8.1c5,0,10,0.7,14.9,1.9V156c-4.8,2.6-10.2,3.9-15.6,3.9C795.9,159.9,791.1,156.8,791,151.7 M798.7,177.5
+	c8.8,0,16-1.9,22.6-6.3v5h24.8v-52.5c0-20-13.5-30.9-35.9-30.9c-12.6,0-25,2.9-38.3,9l9,18.4c9.6-4,17.7-6.5,24.8-6.5
+	c10.3,0,15.6,4,15.6,12.2v4c-6.1-1.6-12.3-2.4-18.6-2.3c-21.1,0-33.8,8.8-33.8,24.6C768.9,166.6,780.4,177.6,798.7,177.5
+	 M662.5,176.2h26.7v-42.5h44.6v42.5h26.7V67.7h-26.6v41.7h-44.6V67.7h-26.7L662.5,176.2z M561,135.1c0-11.8,9.3-20.8,21.5-20.8
+	c6.4-0.1,12.6,2.1,17.4,6.4v28.6c-4.7,4.4-10.9,6.7-17.4,6.5C570.5,155.8,561,146.8,561,135.1 M600.2,176.1H625V62.3l-25,5.4v30.8
+	c-6.4-3.6-13.6-5.5-20.9-5.4c-23.9,0-42.6,18.4-42.6,42c-0.3,23,18.1,41.9,41.1,42.2c0.2,0,0.5,0,0.7,0c7.9,0,15.6-2.5,22-7.1V176.1
+	z M486.5,113.2c7.9,0,14.6,5.1,17.2,13h-34.2C471.9,118,478.2,113.2,486.5,113.2 M444.2,135.2c0,23.9,19.5,42.5,44.6,42.5
+	c13.8,0,23.9-3.7,34.3-12.4l-16.6-14.7c-3.9,4-9.6,6.2-16.4,6.2c-8.8,0.2-16.8-4.9-20.2-13h58.4v-6.2c0-26-17.5-44.8-41.4-44.8
+	c-23.2-0.4-42.4,18.2-42.7,41.5C444.2,134.6,444.2,134.9,444.2,135.2 M400.9,90.5c8.8,0,13.8,5.6,13.8,12.2s-5,12.2-13.8,12.2h-26.3
+	V90.5H400.9z M347.9,176.2h26.7v-39.5h20.3l20.5,39.5h29.7l-23.9-43.4c12.4-5,20.5-17.1,20.4-30.5c0-19.5-15.3-34.5-38.3-34.5H348
+	L347.9,176.2z"/>
+</svg>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/tasks/main.yml

@@ -0,0 +1,22 @@
+---
+- name: Define namespace
+  redhat.openshift.k8s:
+    wait: true
+    state: present
+    api_version: v1
+    kind: Namespace
+    name: patching-report
+
+- name: Define deployment resources
+  redhat.openshift.k8s:
+    wait: true
+    state: present
+    namespace: patching-report
+    definition: "{{ lookup('ansible.builtin.template', 'resources.yaml.j2') }}"
+  register: report_ocp_patching_resources_output
+
+- name: Display link to patching report
+  ansible.builtin.debug:
+    msg:
+      - "Patching report availbable at:"
+      - "{{ report_ocp_patching_resources_output.result.results[3].result.spec.port.targetPort }}://{{ report_ocp_patching_resources_output.result.results[3].result.spec.host }}"

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/header.j2

@@ -0,0 +1,15 @@
+
+
+  <div class="wrapper">
+    <header>
+      <div class="header-container">
+        <a href="https://ansible.com">
+          <img
+            class="header-logo"
+            src="redhat-ansible-logo.svg"
+            title="Red Hat Ansible"
+            alt="Red Hat Ansible"
+          />
+        </a>
+      </div>
+    </header>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/landing.j2

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title> Ansible Linux Automation Report </title>
+  <link rel="stylesheet" type="text/css" href="//fonts.googleapis.com/css?family=Open+Sans" />
+  <link rel="stylesheet" href="//code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
+  <link rel="stylesheet" href="new.css">
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
+<script src="https://code.jquery.com/jquery-1.12.4.js"></script>
+<script src="https://code.jquery.com/ui/1.12.1/jquery-ui.js"></script>
+<script src="https://www.kryogenix.org/code/browser/sorttable/sorttable.js"></script>
+</head>
+<body>
+<div class="wrapper">
+  {% include 'header.j2' %}
+<section>
+<center>
+<h1>Ansible Automation Reports</h1>
+<h3><input type="search" placeholder="Search..." class="form-control search-input" data-table="main_net_table"/>
+</center>
+<table class="table table-striped mt32 main_net_table">
+<tbody>
+{% for report in reports %}
+        <tr>
+            <td class="summary_info">
+              <div id="hostname">
+                <p class="hostname"> <img class="router_image" src="report.png"></p>
+              </div>
+            </td>
+            <td>
+              <a href="{{ report }}"> {{ report }} <a>
+            </td>
+{% endfor %}
+</tbody>
+</table>
+<center><p>Created with</p><br><img src="webpage_logo.png" width="300">
+</center>
+</section>
+</div>
+</body>
+</html>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/new.css.j2

@@ -0,0 +1,202 @@
+p.hostname {
+    color: #000000;
+    font-weight: bolder;
+    font-size: large;
+    margin: auto;
+    width: 50%;
+  }
+
+  #subtable {
+    background: #ebebeb;
+    margin: 0px;
+    width: 100%;
+  }
+
+  #subtable tbody tr td {
+    padding: 5px 5px 5px 5px;
+  }
+
+  #subtable thead th {
+    padding: 5px;
+  }
+
+  * {
+    -moz-box-sizing: border-box;
+    -webkit-box-sizing: border-box;
+    box-sizing: border-box;
+    font-family: "Open Sans", "Helvetica";
+
+  }
+
+  a {
+    color: #000000;
+  }
+
+  p {
+    color: #ffffff;
+  }
+  h1 {
+    text-align: center;
+    color: #ffffff;
+  }
+
+  body {
+    background:#353a40;
+    padding: 0px;
+    margin: 0px;
+    font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
+  }
+
+  table {
+    border-collapse: separate;
+    background:#fff;
+    @include border-radius(5px);
+    @include box-shadow(0px 0px 5px rgba(0,0,0,0.3));
+  }
+
+  .main_net_table {
+    margin:50px auto;
+  }
+
+  thead {
+    @include border-radius(5px);
+  }
+
+  thead th {
+    font-size:16px;
+    font-weight:400;
+    color:#fff;
+    @include text-shadow(1px 1px 0px rgba(0,0,0,0.5));
+    text-align:left;
+    padding:20px;
+    border-top:1px solid #858d99;
+    background: #353a40;
+
+    &:first-child {
+     @include border-top-left-radius(5px);
+    }
+
+    &:last-child {
+      @include border-top-right-radius(5px);
+    }
+  }
+
+  tbody tr td {
+    font-weight:400;
+    color:#5f6062;
+    font-size:13px;
+    padding:20px 20px 20px 20px;
+    border-bottom:1px solid #e0e0e0;
+  }
+
+  tbody tr:nth-child(2n) {
+    background:#f0f3f5;
+  }
+
+  tbody tr:last-child td {
+    border-bottom:none;
+    &:first-child {
+      @include border-bottom-left-radius(5px);
+    }
+    &:last-child {
+      @include border-bottom-right-radius(5px);
+    }
+  }
+
+  td {
+    vertical-align: top;
+  }
+
+  span.highlight {
+      background-color: yellow;
+  }
+
+  .expandclass {
+    color: #5f6062;
+  }
+
+  .content{
+           display:none;
+           margin: 10px;
+  }
+
+  header {
+    width: 100%;
+    position: initial;
+    float: initial;
+    padding: 0;
+    margin: 0;
+    border-radius: 0;
+    height: 88px;
+    background-color: #171717;
+  }
+
+  .header-container {
+    margin: 0 auto;
+    width: 100%;
+    height: 100%;
+    max-width: 1170px;
+    padding: 0;
+    float: initial;
+    display: flex;
+    align-items: center;
+  }
+
+  .header-logo {
+    width: 137px;
+    border: 0;
+    margin: 0;
+    margin-left: 15px;
+  }
+
+  .header-link {
+    margin-left: 40px;
+    text-decoration: none;
+    cursor: pointer;
+    text-transform: uppercase;
+    font-size: 15px;
+    font-family: 'Red Hat Text';
+    font-weight: 500;
+  }
+
+  .header-link:hover {
+    text-shadow: 0 0 0.02px white;
+    text-decoration: none;
+  }
+
+  table.net_info td {
+    padding: 5px;
+}
+
+p.expandclass:hover {
+    text-decoration: underline;
+    color: #EE0000;
+    cursor: pointer;
+}
+
+.summary_info {
+}
+
+.ui-state-active, .ui-widget-content .ui-state-active, .ui-widget-header .ui-state-active, a.ui-button:active, .ui-button:active, .ui-button.ui-state-active:hover {
+    border: 1px solid #5F0000;
+    background: #EE0000;
+}
+
+div#net_content {
+    padding: 0px;
+    height: auto !important;
+}
+
+img.router_image {
+    vertical-align: middle;
+    padding: 0px 10px 10px 10px;
+    width: 50px;
+}
+
+table.net_info {
+    width: 100%;
+}
+
+p.internal_label {
+    color: #000000;
+}

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/packages.j2

@@ -0,0 +1,31 @@
+<!–– INTERNAL TABLE FOR PACKAGES --!>
+<div id="accordion">
+<div class="ui-accordion ui-widget ui-helper-reset" role="tablist">
+<h3 class="ui-accordion-header ui-corner-top ui-state-default ui-accordion-icons ui-accordion-header-collapsed ui-corner-all" role="tab" id="ui-id-3" aria-controls="ui-id-4" aria-selected="false" aria-expanded="false" tabindex="0">Package Facts</h3>
+<div class="net_content ui-accordion-content ui-corner-bottom ui-helper-reset ui-widget-content" id="ui-id-4" aria-labelledby="ui-id-3" role="tabpanel" aria-hidden="true" style="display: none; height: 194px;">
+<table id="subtable" class="sortable">
+    <thead>
+        <tr>
+            <th>Package Name</th>
+            <th>source</th>
+            <th>release</th>
+            <th>version</th>
+        </tr>
+    </thead>
+    <tbody>
+    {% if hostvars[linux_host]['packages'] is defined %}
+    {% for package in hostvars[linux_host]['packages'] %}
+        <tr>
+            <td>{{package['name']}}</td>
+            <td>{{package['source']}}</td>
+            <td>{{package['release']}}</td>
+            <td>{{package['version']}}</td>
+        </tr>
+{% endfor %}
+{% endif %}
+    </tbody>
+</table>
+</div>
+</div>
+</div>
+<!–– END INTERNAL TABLE FOR PACKAGES --!>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/patch.j2

@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title> Linux Patch Report </title>
+</head>
+<body>
+<center>
+<h1>Ansible Linux Patching Report</h1>
+<style>
+@media print {
+   .noprint {
+        display: none !important;
+    }
+}
+</style>
+<div class="noprint">
+<button type="button" onclick="tableToCSV()">Download CSV</button>
+<input type="button" value="Print" onClick="window.print()">
+</div>
+</center>
+<table border = "1" cellpadding = "5" cellspacing = "5">
+    <thead>
+        <tr>
+            <th>Hostname</th>
+            <th>Operating System</th>
+            <th>Operating System Version</th>
+            <th>Required Updates</th>
+        </tr>
+    </thead>
+    <tbody>
+{% for linux_host in ansible_play_hosts |sort %}
+        <tr>
+            <td>{{hostvars[linux_host]['inventory_hostname']}}</td>
+            <td>{{hostvars[linux_host]['ansible_os_family']|default("none")}}</td>
+            <td>{{hostvars[linux_host]['ansible_distribution_version']|default("none")}}</td>
+            <td>
+              <ul>
+{% if hostvars[linux_host].patch_linux_patchingresult_yum.changed|default("false",true) == true %}
+{% for packagename in hostvars[linux_host].patch_linux_patchingresult_yum.changes.updated|sort %}
+        <li> {{ packagename[0] }} - {{ packagename[1] }} </li>
+{% endfor %}
+{% elif hostvars[linux_host].patch_linux_patchingresult_dnf.changed|default("false",true) == true %}
+{% for packagename in hostvars[linux_host].patch_linux_patchingresult_dnf.results|sort %}
+        <li> {{ packagename }} </li>
+{% endfor %}
+{% elif hostvars[linux_host].patch_linux_patchingresult_dnf.changed is undefined %}
+        <li> Patching Failed </li>
+{% elif hostvars[linux_host].patch_linux_patchingresult_yum.changed is undefined %}
+        <li> Patching Failed </li>
+{% else %}
+        <li> Compliant </li>
+{% endif %}
+              </ul>
+            </td>
+        </tr>
+{% endfor %}
+    </tbody>
+</table>
+<center><p>Created with Ansible on {{hostvars[inventory_hostname].ansible_date_time.iso8601}}</p></center>
+<script type="text/javascript">
+function tableToCSV() {
+
+    // Variable to store the final csv data
+    var csv_data = [];
+
+    // Get each row data
+    var rows = document.getElementsByTagName('tr');
+    for (var i = 0; i < rows.length; i++) {
+
+        // Get each column data
+        var cols = rows[i].querySelectorAll('td,th');
+
+        // Stores each csv row data
+        var csvrow = [];
+        for (var j = 0; j < (cols.length); j++) {
+
+            // Get the text data of each cell of
+            // a row and push it to csvrow
+            if ( j == cols.length-1 && i==0){}
+            else{
+            csvrow.push(cols[j].textContent.replace(/,/g, " "));
+            }
+
+       }
+       csv_data.push(csvrow.join(","));
+}
+
+    // combine each row data with new line character
+    csv_data = csv_data.join('\n');
+
+    // Call this function to download csv file
+    downloadCSVFile(csv_data);
+}
+function downloadCSVFile(csv_data) {
+
+    // Create CSV file object and feed our
+    // csv_data into it
+    CSVFile = new Blob([csv_data], { type: "text/csv" });
+
+    // Create to temporary link to initiate
+    // download process
+    var temp_link = document.createElement('a');
+    var todayDate = new Date().toISOString().slice(0, 10);
+
+    // Download csv file
+    temp_link.download = "linuxpatching-" + todayDate + ".csv";
+    var url = window.URL.createObjectURL(CSVFile);
+    temp_link.href = url;
+
+    // This link should not be displayed
+    temp_link.style.display = "none";
+    document.body.appendChild(temp_link);
+
+    // Automatically click the link to trigger download
+    temp_link.click();
+    document.body.removeChild(temp_link);
+}
+</script>
+</body>
+</html>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/report.j2

@@ -0,0 +1,105 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title> Ansible Linux Automation Report </title>
+  <link rel="stylesheet" type="text/css" href="//fonts.googleapis.com/css?family=Open+Sans" />
+  <link rel="stylesheet" href="//code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
+  <link rel="stylesheet" href="new.css">
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
+<script src="https://code.jquery.com/jquery-1.12.4.js"></script>
+<script src="https://code.jquery.com/ui/1.12.1/jquery-ui.js"></script>
+<script src="https://www.kryogenix.org/code/browser/sorttable/sorttable.js"></script>
+<script>
+$(function() {
+$( "#accordion > div" ).accordion({
+    header: "h3",
+    active: false,
+collapsible: true
+});
+});
+</script>
+<script>
+        (function(document) {
+            'use strict';
+
+            var TableFilter = (function(myArray) {
+                var search_input;
+
+                function _onInputSearch(e) {
+                    search_input = e.target;
+                    var tables = document.getElementsByClassName(search_input.getAttribute('data-table'));
+                    myArray.forEach.call(tables, function(table) {
+                        myArray.forEach.call(table.tBodies, function(tbody) {
+                            myArray.forEach.call(tbody.rows, function(row) {
+                                var text_content = row.textContent.toLowerCase();
+                                var search_val = search_input.value.toLowerCase();
+                                row.style.display = text_content.indexOf(search_val) > -1 ? '' : 'none';
+                            });
+                        });
+                    });
+                }
+
+                return {
+                    init: function() {
+                        var inputs = document.getElementsByClassName('search-input');
+                        myArray.forEach.call(inputs, function(input) {
+                            input.oninput = _onInputSearch;
+                        });
+                    }
+                };
+            })(Array.prototype);
+
+            document.addEventListener('readystatechange', function() {
+                if (document.readyState === 'complete') {
+                    TableFilter.init();
+                }
+            });
+
+        })(document);
+    </script>
+</head>
+<body>
+<div class="wrapper">
+  {% include 'header.j2' %}
+<section>
+<center>
+<h1>Ansible Linux Automation Report</h1>
+<h3><input type="search" placeholder="Search..." class="form-control search-input" data-table="main_net_table"/>
+</center>
+<table class="table table-striped mt32 main_net_table">
+    <thead>
+        <tr>
+            <th>Linux Device</th>
+            <th>Package Manager</th>
+            <th>Operating System</th>
+            <th>Operating System Version</th>
+            <th>Operating System Kernel Version</th>
+        </tr>
+    </thead>
+    <tbody>
+{% for linux_host in ansible_play_hosts |sort %}
+        <tr>
+            <td class="summary_info">
+              <div id="hostname">
+                <p class="hostname">
+                  <img class="router_image" src="server.png"> {{ hostvars[linux_host]['inventory_hostname'].split('.')[0] }}</p>
+                </div>
+{% if detailedreport == 'True' %}
+{% include 'packages.j2' %}
+{% include 'services.j2' %}
+{% endif %}
+</td>
+            <td>{{hostvars[linux_host]['ansible_pkg_mgr']|default("none")}}</td>
+            <td>{{hostvars[linux_host]['ansible_os_family']|default("none")}}</td>
+            <td>{{hostvars[linux_host]['ansible_distribution_version']|default("none")}}</td>
+            <td>{{hostvars[linux_host]['ansible_kernel']|default("none")}}</td>
+        </tr>
+{% endfor %}
+    </tbody>
+</table>
+<center><p>Created with</p><br><img src="webpage_logo.png" width="300">
+</center>
+</section>
+</div>
+</body>
+</html>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/resources.yaml.j2

@@ -0,0 +1,94 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: linux-patching-report
+  labels:
+    app: linux-patching-report
+data:
+  index.html: |
+    {% filter indent(width=4) %}
+    {%- include 'landing.j2' %}
+    {% endfilter %}
+
+  linux.html: |
+    {% filter indent(width=4) %}
+    {%- include 'report.j2' %}
+    {% endfilter %}
+
+  linuxpatch.html: |
+    {% filter indent(width=4) %}
+    {%- include 'patch.j2' %}
+    {% endfilter %}
+
+  new.css: |
+    {% filter indent(width=4) %}
+    {%- include 'new.css.j2' %}
+    {% endfilter %}
+
+binaryData:
+  server.png: {{ lookup('ansible.builtin.file', 'server.png') | b64encode }}
+  report.png: {{ lookup('ansible.builtin.file', 'report.png') | b64encode }}
+  webpage_logo.png: {{ lookup('file', 'webpage_logo.png') | b64encode }}
+  redhat-ansible-logo.svg: {{ lookup('ansible.builtin.file', 'redhat-ansible-logo.svg') | b64encode }}
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: linux-patching-report
+  labels:
+    app: linux-patching-report
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: linux-patching-report
+  template:
+    metadata:
+      labels:
+        app: linux-patching-report
+    spec:
+      terminationGracePeriodSeconds: 1
+      containers:
+      - image: registry.redhat.io/rhel8/httpd-24
+        name: report-server
+        volumeMounts:
+        - name: html
+          mountPath: /var/www/html
+      volumes:
+      - name: html
+        configMap:
+          name: linux-patching-report
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: linux-patching-report
+  name: linux-patching-report
+spec:
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: linux-patching-report
+  type: ClusterIP
+---
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  labels:
+    app: linux-patching-report
+  name: linux-patching-report
+spec:
+  to:
+    kind: Service
+    name: linux-patching-report
+    weight: 100
+  port:
+    targetPort: http
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Redirect

collections/ansible_collections/demo/patching/roles/report_ocp_patching/templates/services.j2

@@ -0,0 +1,30 @@
+<!–– INTERNAL TABLE FOR SERVICES --!>
+<div id="accordion">
+<div class="ui-accordion ui-widget ui-helper-reset" role="tablist">
+<h3 class="ui-accordion-header ui-corner-top ui-state-default ui-accordion-icons ui-accordion-header-collapsed ui-corner-all" role="tab" id="ui-id-3" aria-controls="ui-id-4" aria-selected="false" aria-expanded="false" tabindex="0">Services Facts</h3>
+<div class="net_content ui-accordion-content ui-corner-bottom ui-helper-reset ui-widget-content" id="ui-id-4" aria-labelledby="ui-id-3" role="tabpanel" aria-hidden="true" style="display: none; height: 194px;">
+<table id="subtable" class="sortable">
+    <thead>
+        <tr>
+            <th>Service Name</th>
+            <th>State</th>
+            <th>Source</th>
+        </tr>
+    </thead>
+    <tbody>
+    {% if hostvars[linux_host]['services'] is defined %}
+    {% for servicesname in hostvars[linux_host]['services']|sort %}
+    {% set service = hostvars[linux_host]['services'][servicesname] %}
+        <tr>
+            <td>{{service['name']}}</td>
+            <td>{{service['state']}}</td>
+            <td>{{service['source']}}</td>
+        </tr>
+{% endfor %}
+{% endif %}
+    </tbody>
+</table>
+</div>
+</div>
+</div>
+<!–– END INTERNAL TABLE FOR SERVICES --!>

collections/ansible_collections/demo/patching/roles/report_ocp_patching/vars/main.yml

@@ -0,0 +1 @@
+---

collections/ansible_collections/demo/patching/roles/report_server/tasks/apache.yml

@@ -2,16 +2,8 @@
 - name: Include system variables
   ansible.builtin.include_vars: "{{ ansible_system }}.yml"
 
-- name: Permit traffic in default zone for http service
-  ansible.posix.firewalld:
-    service: http
-    permanent: true
-    state: enabled
-    immediate: true
-  check_mode: false
-
 - name: Install httpd package
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name: httpd
     state: installed
   check_mode: false
@@ -30,8 +22,10 @@
     mode: "0644"
   check_mode: false
 
-- name: Install httpd service
+- name: Start httpd service
   ansible.builtin.service:
     name: httpd
     state: started
   check_mode: false
+
+...

collections/ansible_collections/demo/patching/roles/report_server/tasks/linux_landing_page.yml

@@ -6,7 +6,7 @@
   ansible.builtin.find:
     paths: "{{ doc_root }}/{{ reports_dir }}"
     patterns: '*.html'
-  register: reports
+  register: report_server_reports
   check_mode: false
 
 - name: Publish landing page

collections/ansible_collections/demo/patching/roles/report_server/tasks/windows_landing_page.yml

@@ -6,7 +6,7 @@
   ansible.windows.win_find:
     paths: "{{ doc_root }}/{{ reports_dir }}"
     patterns: '*.html'
-  register: reports
+  register: report_server_reports
   check_mode: false
 
 - name: Publish landing page

collections/ansible_collections/demo/patching/roles/report_server/templates/linux_report.j2

@@ -20,7 +20,7 @@
 </center>
 <table class="table table-striped mt32 main_net_table">
 <tbody>
-{% for report in reports.files %}
+{% for report in report_server_reports.files %}
         {% set page = report.path.split('/')[-1] %}
         <tr>
             <td class="summary_info">

collections/ansible_collections/demo/patching/roles/report_server/templates/windows_report.j2

@@ -20,7 +20,7 @@
 </center>
 <table class="table table-striped mt32 main_net_table">
 <tbody>
-{% for report in reports.files %}
+{% for report in report_server_reports.files %}
         {% set page = report.path.split('\\')[-1] %}
         <tr>
             <td class="summary_info">

collections/ansible_collections/demo/satellite/roles/register_host/tasks/main.yml

@@ -10,7 +10,7 @@
     name: "{{ instance_name }}"
 
 - name: Remove rhui client packages
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name:
       - google-rhui-client*
       - rh-amazon-rhui-client*
@@ -19,17 +19,17 @@
 - name: Get current repos
   ansible.builtin.command:
     cmd: ls /etc/yum.repos.d/
-  register: repos
+  register: register_host_repos
   changed_when: false
 
 - name: Remove existing rhui repos
   ansible.builtin.file:
     path: "/etc/yum.repos.d/{{ item }}"
     state: absent
-  loop: "{{ repos.stdout_lines }}"
+  loop: "{{ register_host_repos.stdout_lines }}"
 
 - name: Install satellite certificate
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name: "{{ satellite_url }}/pub/katello-ca-consumer-latest.noarch.rpm"
     state: present
     validate_certs: false
@@ -53,7 +53,7 @@
     state: enabled
 
 - name: Install satellite client
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name:
       - katello-host-tools
       - katello-host-tools-tracer

collections/ansible_collections/demo/satellite/roles/scap_client/tasks/main.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Install openscap client packages
-  ansible.builtin.yum:
+  ansible.builtin.dnf:
     name:
       - openscap-scanner
       - rubygem-foreman_scap_client
@@ -15,18 +15,18 @@
     force_basic_auth: true
     body_format: json
     validate_certs: false
-  register: policies
+  register: scap_client_policies
   no_log: "{{ foreman_operations_scap_client_secure_logging }}"
 
 - name: Build policy {{ policy_name }}
   ansible.builtin.set_fact:
-    policy: "{{ policy | default([]) }} + {{ [item] }}"
-  loop: "{{ policies.json.results }}"
+    scap_client_policy: "{{ scap_client_policy | default([]) }} + {{ [item] }}"
+  loop: "{{ scap_client_policies.json.results }}"
   when: item.name in policy_name or policy_name == 'all'
 
 - name: Fail if no policy found with required name
   ansible.builtin.fail:
-  when: policy is not defined
+  when: scap_client_policy is not defined
 
 - name: Get scap content information
   ansible.builtin.uri:
@@ -37,8 +37,8 @@
     force_basic_auth: false
     body_format: json
     validate_certs: false
-  register: scapcontents
-  loop: "{{ policy }}"
+  register: scap_client_scapcontents
+  loop: "{{ scap_client_policy }}"
   no_log: "{{ foreman_operations_scap_client_secure_logging }}"
 
 - name: Get tailoring content information
@@ -50,21 +50,21 @@
     force_basic_auth: false
     body_format: json
     validate_certs: false
-  register: tailoringfiles
+  register: scap_client_tailoringfiles
   when: item.tailoring_file_id | int > 0 | d(False)
-  loop: "{{ policy }}"
+  loop: "{{ scap_client_policy }}"
   no_log: "{{ foreman_operations_scap_client_secure_logging }}"
 
 - name: Build scap content parameters
   ansible.builtin.set_fact:
-    scap_content: "{{ scap_content | default({}) | combine({item.json.id: item.json}) }}"
-  loop: "{{ scapcontents.results }}"
+    scap_client_scap_content: "{{ scap_client_scap_content | default({}) | combine({item.json.id: item.json}) }}"
+  loop: "{{ scap_client_scapcontents.results }}"
 
 - name: Build tailoring content parameters
   ansible.builtin.set_fact:
-    tailoring_files: "{{ tailoring_files | default({}) | combine({item.json.id: item.json}) }}"
+    scap_client_tailoring_files: "{{ scap_client_tailoring_files | default({}) | combine({item.json.id: item.json}) }}"
   when: item.json is defined
-  loop: "{{ tailoringfiles.results }}"
+  loop: "{{ scap_client_tailoringfiles.results }}"
 
 - name: Apply openscap client configuration template
   ansible.builtin.template:
@@ -78,7 +78,7 @@
 #   cron:
 #     name: "Openscap Execution"
 #     cron_file: 'foreman_openscap_client'
-#     job: '/usr/bin/foreman_scap_client {{policy.id}} > /dev/null'
+#     job: '/usr/bin/foreman_scap_client {{scap_client_policy.id}} > /dev/null'
 #     weekday: "{{crontab_weekdays}}"
 #     hour: "{{crontab_hour}}"
 #     minute: "{{crontab_minute}}"

collections/requirements.yml

@@ -1,30 +1,6 @@
 ---
-collections:
-  - name: ansible.controller
-  - name: infra.ah_configuration
-  - name: infra.controller_configuration
-  - name: redhat_cop.controller_configuration
-  # linux
-  - name: ansible.posix
-  - name: community.general
-    version: ">=8.0.0"
-  - name: containers.podman
-  - name: redhat.insights
-  - name: redhat.rhel_system_roles
-  # windows
-  - name: ansible.windows
-  - name: chocolatey.chocolatey
-  - name: community.windows
-  # cloud
-  - name: amazon.aws
-  # satellite
-  - name: redhat.satellite
-  # network
-  - name: ansible.netcommon
-  - name: cisco.ios
-  - name: cisco.iosxr
-  - name: cisco.nxos
-  # openshift
-  - name: kubernetes.core
-  - name: redhat.openshift
-  - name: redhat.openshift_virtualization
+# required collections are installed in the Product Demos EE.
+# additional collections needed during testing can be added here.
+collections: []
+
+...

common/README.md

@@ -0,0 +1,3 @@
+# Common Prerequisites
+
+Demos from some categories (cloud, linux, windows, etc.) have become dependent on controller resources defined in other demo categories.  The setup.yml file in this directory is used to configure these common prerequisites so that they are available before setup for a demo category is called.

common/setup.yml

@@ -0,0 +1,329 @@
+---
+controller_execution_environments:
+  - name: Cloud Services Execution Environment
+    image: quay.io/scottharwell/cloud-ee:latest
+
+controller_organizations:
+  - name: Default
+    default_environment: Product Demos EE
+
+controller_projects:
+  - name: Ansible Cloud Content Lab - AWS
+    organization: Default
+    scm_type: git
+    wait: true
+    scm_url: https://github.com/ansible-content-lab/aws.infrastructure_config_demos.git
+    default_environment: Cloud Services Execution Environment
+
+  - name: Ansible Cloud AWS Demos
+    organization: Default
+    scm_type: git
+    wait: true
+    scm_url: https://github.com/ansible-cloud/aws_demos.git
+    default_environment: Cloud Services Execution Environment
+
+controller_credentials:
+  - name: AWS
+    credential_type: Amazon Web Services
+    organization: Default
+    update_secrets: false
+    state: exists
+    inputs:
+      username: REPLACEME
+      password: REPLACEME
+
+controller_inventory_sources:
+  - name: AWS Inventory
+    organization: Default
+    source: ec2
+    inventory: Demo Inventory
+    credential: AWS
+    overwrite: true
+    source_vars:
+      hostnames:
+        - tag:Name
+      compose:
+        ansible_host: public_ip_address
+        ansible_user: ec2-user
+      groups:
+        cloud_aws: true
+        os_linux: "platform_details == 'Red Hat Enterprise Linux'"
+        os_windows: "platform_details == 'Windows'"
+
+      keyed_groups:
+        - key: tags.blueprint
+          prefix: blueprint
+        - key: tags.owner
+          prefix: owner
+        - key: tags.purpose
+          prefix: purpose
+        - key: tags.deployment
+          prefix: deployment
+        - key: tags.Compliance
+          separator: ''
+
+controller_groups:
+  - name: cloud_aws
+    inventory: Demo Inventory
+    variables:
+      ansible_user: ec2-user
+  - name: os_windows
+    inventory: Demo Inventory
+    variables:
+      ansible_connection: winrm
+      ansible_winrm_transport: credssp
+      ansible_winrm_server_cert_validation: ignore
+      ansible_port: 5986
+
+controller_templates:
+  - name: SUBMIT FEEDBACK
+    job_type: run
+    inventory: Demo Inventory
+    project: Ansible Product Demos
+    playbook: feedback.yml
+    execution_environment: Default execution environment
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Name/Email/Contact
+          type: text
+          variable: email
+          required: true
+        - question_name: Issue or Feedback
+          type: textarea
+          variable: feedback
+          required: true
+
+  - name: Cloud / AWS / Create VPC
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+    project: Ansible Product Demos
+    playbook: cloud/create_vpc.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Owner
+          type: text
+          variable: aws_owner_tag
+          required: true
+
+  - name: Cloud / AWS / Create Keypair
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+    project: Ansible Product Demos
+    playbook: cloud/aws_key.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Keypair Name
+          type: text
+          variable: aws_key_name
+          required: true
+          default: aws-test-key
+        - question_name: Keypair Public Key
+          type: textarea
+          variable: aws_public_key
+          required: true
+        - question_name: Owner
+          type: text
+          variable: aws_keypair_owner
+          required: true
+
+  - name: Cloud / AWS / Create VM
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+      - Demo Credential
+    project: Ansible Cloud Content Lab - AWS
+    playbook: playbooks/create_vm.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    allow_simultaneous: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Name
+          type: text
+          variable: create_vm_vm_name
+          required: true
+        - question_name: Owner
+          type: text
+          variable: create_vm_vm_owner
+          required: true
+        - question_name: Deployment
+          type: text
+          variable: create_vm_vm_deployment
+          required: true
+        - question_name: Purpose
+          type: text
+          variable: create_vm_vm_purpose
+          required: true
+          default: demo
+        - question_name: Environment
+          type: multiplechoice
+          variable: create_vm_vm_environment
+          required: true
+          choices:
+            - Dev
+            - QA
+            - Prod
+        - question_name: Blueprint
+          type: multiplechoice
+          variable: vm_blueprint
+          required: true
+          choices:
+            - windows_core
+            - windows_full
+            - rhel9
+            - rhel8
+            - rhel7
+            - al2023
+        - question_name: Subnet
+          type: text
+          variable: create_vm_aws_vpc_subnet_name
+          required: true
+          default: aws-test-subnet
+        - question_name: Security Group
+          type: text
+          variable: create_vm_aws_securitygroup_name
+          required: true
+          default: aws-test-sg
+        - question_name: SSH Keypair
+          type: text
+          variable: create_vm_aws_keypair_name
+          required: true
+          default: aws-test-key
+        - question_name: AWS Instance Type (defaults to blueprint value)
+          type: text
+          variable: create_vm_aws_instance_size
+          required: false
+        - question_name: AWS Image Filter (defaults to blueprint value)
+          type: text
+          variable: create_vm_aws_image_filter
+          required: false
+
+  - name: Cloud / AWS / Delete VM
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+      - Demo Credential
+    project: Ansible Cloud Content Lab - AWS
+    playbook: playbooks/delete_inventory_vm.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Name or Pattern
+          type: text
+          variable: _hosts
+          required: true
+
+  - name: Cloud / AWS / Resize EC2
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+      - Controller Credential
+    project: Ansible Product Demos
+    playbook: cloud/resize_ec2.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: aws_region
+          required: true
+          default: us-east-1
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Specify target hosts
+          type: text
+          variable: _hosts
+          required: true
+
+        - question_name: Specify target instance type
+          type: text
+          variable: instance_type
+          default: t3a.medium
+          required: true
+
+controller_notifications:
+  - name: Telemetry
+    organization: Default
+    notification_type: webhook
+    notification_configuration:
+      url: https://script.google.com/macros/s/AKfycbzxUObvCJ6ZbzfJyicw4RvxlGE3AZdrK4AR5-TsedCYd7O-rtTOVjvsRvqyb3rx6B0g8g/exec
+      http_method: POST
+      headers: {}
+
+controller_settings:
+  - name: SESSION_COOKIE_AGE
+    value: 180000

execution_environments/README.md

@@ -0,0 +1,16 @@
+# Execution Environment Images for Ansible Product Demos
+
+When the Ansible Product Demos setup job template is run, it creates a number of execution environment definitions on the automation controller.  The content of this directory is used to create and update the default APD execution environment images defined during the setup process, [quay.io/ansible-product-demos/apd-ee-25](quay.io/ansible-product-demos/apd-ee-25).
+
+Currently the execution environment image is created manually using the `build.sh` script, with a future goal of building in a CI pipeline when the EE definition or requirements are updated.
+
+## Building the execution environment images
+
+1. `podman login registry.redhat.io` in order to pull the base EE images
+2. `export ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN="<token>"` obtained from [Automation Hub](https://console.redhat.com/ansible/automation-hub/token)
+3. `export ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN="<token>"` (same token as above)
+4. `./build.sh` to build the EE image
+
+The `build.sh` script creates a multi-architecture EE image for the amd64 (x86_64) and arm64 (aarch64) platforms.  It does so by creating the build context using `ansible-builder create`, then creating a podman manifest definition and building an EE image for each supported platform.
+
+NOTE: Podman will use qemu to emulate the non-native architecture at build time, so the build must be performed on a system which includes the qemu-user-static package.  Builds have only been tested on MacOS using podman-desktop with the native Fedora-based podman machine.

execution_environments/ansible.cfg

@@ -0,0 +1,15 @@
+[defaults]
+
+[galaxy]
+server_list = certified, validated, community_galaxy
+
+[galaxy_server.certified]
+url=https://cloud.redhat.com/api/automation-hub/content/published/
+auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+
+[galaxy_server.validated]
+url=https://cloud.redhat.com/api/automation-hub/content/validated/
+auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+
+[galaxy_server.community_galaxy]
+url=https://galaxy.ansible.com/